Malware and cyber defence, explained
How to spot a phishing link
To spot a phishing link, find its real domain: the part just before the first single slash, read from the right. In https://paypal.com.secure-login.example/verify the real domain is secure-login.example, not PayPal. If the real domain is not the company the message claims to be from, it is phishing.
Want to check a link now? Paste it into the free link inspector: it shows the real domain and every trick below, and nothing you paste leaves your browser.
How to find the real domain in any link
The real domain is the name the company registered, and it is the only part of a link a scammer cannot fake.
- Skip
https://at the start. - Read up to the first single
/. Everything before it is the host name. - In the host name, take the last two parts, such as
paypal.com. For country endings like.co.uk, take the last three, such asbbc.co.uk. - Ask: is that the company the message says it is from? If not, stop.
https://login.microsoftonline.com/ belongs to microsoftonline.com, which is Microsoft's. https://microsoft.login-online.example/ belongs to login-online.example, which is not.8 red flags in a phishing link
Each of these tricks is designed to make the wrong domain look like the right one.
1. The brand is in the wrong place
paypal.com.secure-login.example
Domains are read from the right. Everything to the left of the real domain is a subdomain its owner can name anything, including paypal.com.
2. A letter is swapped
paypa1.com, rnicrosoft.com, arnazon.co
A digit 1 for an l, "rn" for an m, a zero for an o. At a glance, and on a small screen, they read as the real name.
3. Letters from another alphabet
xn--80ak6aa92e.com, shown by some apps as аррӏе.com
Cyrillic and Latin share lookalike letters. Browsers often show these domains in their xn-- form to warn you; email and chat apps may not.
4. An @ sign in the address
https://www.microsoft.com@login-portal.example/
Browsers treat everything before an @ as a username and ignore it. This link goes to login-portal.example.
5. An IP address instead of a name
http://192.0.2.44/office365/
Real companies send links to their domain name. Raw numbers usually mean a server set up for one campaign.
6. A shortened link
bit.ly/3xYz, tinyurl.com/abc
Shorteners hide the destination. They have honest uses, but a bank or delivery company sending one in a text is a reason to stop.
7. A trusted site that forwards you on
https://www.google.com/url?q=https://refund-desk.example/
Some real sites pass visitors on to any address in the link. The link starts somewhere you trust and ends somewhere you should not.
8. Pressure in the words
/verify-account, /suspended, /refund, /unlock
Phishing wants you to act before you think. Urgency in the link and in the message is a signal on its own.
You can try all eight in the phishing link checker, which has an example of each built in.
Check the link before you tap it
- On a computer: hover over the link and read the address that appears at the bottom of the window. The words of the link can say anything.
- On a phone: press and hold the link until a preview with the address appears. Do not let it open.
- In any doubt: do not use the link at all. Type the company's address yourself, or open its app, and look for the same message there.
Where phishing links lead
Most lead to a copy of a login page that sends whatever you type to the attacker. Others download a file that is really a trojan, often the first step of a ransomware attack. Newer kits sit between you and the real site and copy your session after you log in, which can get past text-message codes. Passkeys and security keys resist this, because they only work on the real domain.
Clicked one already? Change the password from the real site, turn on multi-factor authentication, and if it was a work account, tell your IT team straight away: they would far rather know in minutes than days. For how organisations handle what comes next, see incident response steps.
Questions people ask
Does the padlock (HTTPS) mean a link is safe?
No. HTTPS only means the connection is encrypted. Anyone can get a free certificate for any domain they own, and most phishing sites use HTTPS. The padlock tells you nobody else can read what you send; it does not tell you who you are sending it to.
What happens if I click a phishing link?
Usually nothing yet: most phishing pages need you to type a password or card number, or to download and open a file. If you only opened the page, close it. If you entered a password, change it at once from the real site and turn on multi-factor authentication. If you entered card details, call your bank.
How can I check where a short link goes without clicking it?
Many shorteners have a preview: add a + to the end of a bit.ly link, or use a link-expander service. On a phone, a long press shows the address without opening it. On a computer, hovering over a link shows its address in the corner of the window.