SSRF URL classifier
Paste a URL and see where it actually points: loopback, a private or link-local range, a cloud metadata endpoint, CGNAT, any block of the IANA special-purpose registries, or the public internet. Decimal, octal and hex IP obfuscation is decoded, so is an IPv4 address hidden inside an IPv6 one (IPv4-mapped, IPv4-compatible, NAT64, 6to4, Teredo); dangerous schemes and embedded credentials are flagged, and an SSRF risk level is shown. It never resolves DNS and never sends the request.
Security & WAFEverything is computed in your browser. This tool never resolves DNS and never sends the request; it classifies the address purely from the text you paste.
The classifier decides purely from the URL string and never touches the network: it does not resolve DNS and never issues the request (D-53). It extracts the host from the raw input (not from a normalizing URL parser, which would erase the obfuscation), decodes the inet_aton spellings of an IPv4 address (decimal, octal, hex, short-form), normalises every IPv6 spelling to its RFC 5952 form, and decodes the IPv4 address carried inside six IPv6 layouts: IPv4-mapped (::ffff:0:0/96), the deprecated IPv4-compatible ::a.b.c.d, NAT64 (64:ff9b::/96 and 64:ff9b:1::/48), 6to4 (2002::/16) and Teredo (2001::/32, whose server address and XOR-obfuscated client address are both shown, the more internal one deciding). Every one of the 25 IPv4 and 25 IPv6 rows of the IANA Special-Purpose Address Space registries (read 2026-10-19) is matched most specific first and rated by its own name and Globally Reachable flag: not globally reachable rates reserved unless the row is loopback, private, link-local or CGNAT; globally reachable rates public but is named, and the anycast service addresses (192.0.0.9, 192.0.0.10, 2001:1::1, 2001:1::2, 2001:1::3, and the 6a44 relay 192.88.99.2) are flagged as such. The cloud metadata addresses (169.254.169.254, metadata.google.internal, fd00:ec2::254, 100.100.100.200) outrank their covering rows. Dangerous non-HTTP schemes (file, gopher, dict, ftp, ldap, and similar) and embedded credentials are flagged. The range definitions come from the IANA registries and the RFCs they cite, the SSRF guidance from the OWASP SSRF prevention cheat sheet; behavior is pinned by 113 golden vectors.
- RFC 1918: Address Allocation for Private Internetsprivate IPv4 ranges
- RFC 3927: Dynamic Configuration of IPv4 Link-Local Addresses169.254.0.0/16 link-local
- RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space100.64.0.0/10 CGNAT
- RFC 3986: Uniform Resource Identifier (URI): Generic SyntaxURL structure
- OWASP: Server Side Request Forgery Prevention Cheat SheetSSRF defenses
- IANA: IPv4 Special-Purpose Address Spaceall 25 rows, read 2026-10-19 (registry updated 2025-10-09)
- IANA: IPv6 Special-Purpose Address Spaceall 25 rows, read 2026-10-19 (registry updated 2025-10-09)
- RFC 4291: IP Version 6 Addressing Architecturetext forms, IPv4-compatible and IPv4-mapped addresses
- RFC 6052: IPv6 Addressing of IPv4/IPv6 TranslatorsNAT64 address layouts
- RFC 4380: TeredoTeredo address format and client obfuscation