What this tool checks
An open redirect is a URL on your own domain that forwards visitors somewhere else, controlled entirely by a query parameter your server never validates. This tool sends a request for each of 9 common parameter names (url, next, redirect, and similar), pointing every one at a harmless canary address, and checks whether the response is a redirect that lands exactly on that address — meaning the parameter controls the destination with no allowlist behind it.
Why attackers specifically target this
A phishing link that points straight to evil-site.com gets flagged by every spam filter and looks suspicious to anyone who glances at it. A link like yourdomain.com/login?next=evil-site.com looks completely legitimate — it starts with a domain the victim trusts, sometimes one they already have a relationship with — and only redirects to the attacker's page after the click. Because the initial domain is real, this bypasses domain-reputation checks that block obviously malicious links outright.
The fix is almost always an allowlist
The safe version of a post-login redirect doesn't take an arbitrary URL — it takes a small set of known-safe destinations (or, more simply, only accepts a relative path starting with /, never a full URL with its own host). If your framework's redirect helper accepts a raw string from user input, add a check: does the target start with / and does it not start with // (protocol-relative URLs are still absolute) before ever redirecting to it.