What is checked:
Redirect chain (up to 10 hops) • SSL certificate validity • Domain age via WHOIS • Phishing keywords & suspicious TLDs • IP-based URLs, excessive subdomains, homoglyph characters, URL encoding • HTTP response headers • Google Safe Browsing API (if configured).

Verdict logic: Each finding adds to a risk score. A score of 0-1 = Safe, 2-4 = Suspicious, 5+ = Dangerous.