How to manually test a suspicious URL using curl commands

An unfamiliar link deserves a pause before a browser opens it. A page that offers only “Click here to proceed” and hides its destination behind an obfuscated query parameter gives you almost nothing to assess. That lack of context is not proof of malware, but it is a strong reason to inspect the address in a controlled terminal environment rather than submit information or allow active content to load.

A command-line probe can reveal redirects, response status, certificate details, DNS records and timing while keeping browser cookies, saved logins and JavaScript out of the exchange. That makes terminal testing useful for Australian inboxes carrying messages that impersonate myGov or Service Australia, Australia Post parcel prompts, bank alerts or texts through Telstra, Optus and Vodafone networks. The aim is evidence for a decision, never an automatic declaration that a domain is safe.

Establish a safe testing boundary

Begin by separating investigation from interaction. Use a disposable virtual machine or isolated environment, without a browser session, password manager or privileged corporate access. A destination advertised as visa guidance remains unverified: do not enter a passport, application reference, payment detail or one-time code. If the sender included personal information, assume it may be genuine and confirm the organisation independently before acting.

Store the address in a quoted shell variable so a leading dash cannot be mistaken for an option:

read -r url

Probe	Command	Exposure	Best use
HEAD request	curl -sS -I --max-redirs 0 "$url"	Sends HEAD; little or no body	First status and redirect check
Discard-body GET	curl -sS -D - -o /dev/null --max-redirs 0 "$url"	Sends GET; body is discarded	Headers after a harmless-looking HEAD
Verbose request	curl -sS -v -o /dev/null --max-redirs 0 "$url"	Adds connection and TLS details	Diagnosing transport problems
Limited download	curl -sS --range 0-4095 --max-filesize 1048576 --max-time 20 -o sample.bin "$url"	May still transfer more than requested	Static inspection after earlier checks

Start with headers because they reveal much while transferring little data. HEAD is usually inexpensive, although a poorly built site can answer it differently from a normal visit. GET can trigger server-side actions even when curl discards the body. Avoid paths that clearly delete an account, confirm a subscription or start a payment. Never add browser cookies, an Authorization header or --insecure; disabling certificate checks replaces a useful warning with blind trust.

Inspect headers and redirects

Issue a HEAD request first, with finite timeouts and a protocol allow-list:

curl -sS -I --connect-timeout 10 --max-time 20 \
  --proto '=http,https' --proto-redir '=http,https' --url "$url"

The response status shows whether the endpoint exists, rejects the method or requires authentication. A 405 may mean only that the server dislikes HEAD, not that the URL is safe. A 301, 302, 307 or 308 response needs care. Do not add -L: copy and resolve any Location value, inspect it as a fresh URL and repeat the check without carrying across cookies or one-time query values. Redirects to a raw IP address, an unrelated domain or a newly spelled brand name deserve closer scrutiny, but none proves malicious intent by itself.

After the first response looks non-mutating, this command exposes headers and basic timing while sending the body to null:

curl -sS -D - -o /dev/null --connect-timeout 10 --max-time 20 \
  --proto '=http,https' -w 'status=%{http_code}\nremote_ip=%{remote_ip}\ntype=%{content_type}\nredirect=%{redirect_url}\ntotal=%{time_total}\n' \
  --url "$url"

Read Set-Cookie, Content-Type, Content-Disposition and Cache-Control alongside the status code. An attachment type is worth checking in an isolated environment, while an unexpected cookie can indicate session tracking. One explanation of bare-page response timing appears in a server timing guide, but its claims should be checked just as you would check the target site. A fast reply may reflect a CDN or cache, and a slow one may reflect the distance between Australian cities such as Perth, Sydney and Melbourne. Compare several runs from the same connection rather than treating one delay as a verdict.

Check DNS, TLS, and timing

Separate the hostname from the rest of the URL, then compare its records with the expected organisation. Replace the placeholder with the suspicious hostname:

host='example.test'
dig +short A "$host"
dig +short AAAA "$host"
dig +short CNAME "$host"

Several addresses may be normal for a content delivery network; a CNAME can explain them. Conversely, an unfamiliar CDN target does not identify the operator. Use the records as context, not proof of ownership, and note that a domain registered overseas can still serve an Australian audience.

TLS evidence comes from curl’s normal certificate validation:

curl -sS -v -I --connect-timeout 10 --max-time 20 \
  --proto '=http,https' --url "$url" 2>&1 | less

Look for the resolved IP, certificate subject and issuer, protocol version and any verification error. Curl should reject an invalid certificate by default; do not “fix” that result with -k. Redact local IP, proxy and hostname details before sharing verbose output. Also check the hostname itself for an embedded account, a look-alike character or a suffix that differs from the legitimate brand. An xn-- label may represent an internationalised domain, so decode it with a trusted tool and compare the result.

A .com.au address is not a guarantee of Australian ownership, just as an Australian business may use .com or another country-code domain. Check the legal or trading name against the sender, domain age, published contact details and the purpose of the request. Name resemblance is easy to copy, including within the tightly targeted phishing messages common around Australian banks and government services.

Examine content without executing it

Only retrieve a body when the headers, redirects and path suggest a read-only page. Save it to a disposable directory instead of piping it into a shell or opening it directly:

curl -sS --range 0-4095 --max-filesize 1048576 --max-time 20 \
  --proto '=http,https' --proto-redir '=http,https' \
  --dump-header headers.txt --output sample.bin --url "$url"
file sample.bin

A server may ignore the requested byte range. --max-filesize limits a declared body size but is not a universal transfer cap, so keep the short timeout and check the file size. Curl downloads content; it does not execute JavaScript, yet the response can still contain scripts, form actions or tracking pixels designed for a browser.

Inspect the saved file as inert text and look for structural clues:

strings sample.bin | grep -Eio '<(title|form|script|iframe)[^>]*' | head -40

This can reveal the page title, login form, script sources and embedded frames without rendering them. Do not run any downloaded command, import a certificate or open the file in a browser profile containing real accounts. If the path resolves to an unfamiliar site homepage, compare its wording, branding and contact information with a trusted source, since copied identities are common.

Before sending any request, inspect the query string for email addresses, one-time tokens or a nested redirect. Preserve it for evidence, but do not paste it into a shell, online scanner or untrusted decoder. A suspicious parameter can trigger an action without any visible form.

Record evidence and act safely

Write down the exact time, time zone, original message and result of each probe. Preserve headers and command output in a private incident folder, but redact access tokens, email addresses and tracking identifiers before sharing publicly. If credentials or identity documents may have reached the site, treat containment as urgent: change the affected password from a trusted device, revoke sessions and contact the relevant provider.

A separate source can be one place to look for earlier discussion, provided its operator, date and relevance are checked rather than assumed. Compare reports with the message’s claimed sender, domain history and the organisation’s official communications. A generic “proceed” page with an opaque parameter has no established purpose or operator, so treat unsupported claims cautiously even when the page loads cleanly.

For Australian escalation, use the Australian Signals Directorate’s Report Cyber service, the Australian Cyber Security Centre in Canberra or Scamwatch. For a bank-themed lure, call the number on the back of the card; for a myGov lure, reach the service through its official app; for an Australia Post or telco lure, use the organisation’s established support channel. Open a clean terminal now, run the HEAD check first, and record the status, redirect, certificate, DNS and timing evidence before deciding whether the URL should be reported.