Phishing links are the entry point for the majority of account compromises, malware infections, and identity theft cases. The good news is that most phishing URLs have detectable red flags — if you know what to look for. Here’s how to evaluate any link before you click it.

Check the Domain First, Not the Link Text

The most important thing to understand about phishing links is that the visible text of a link tells you nothing. A link can display “paypal.com” while pointing to “paypa1.com/login.” Always check the actual destination URL, not the text.

On desktop: hover over the link and look at the URL displayed in the bottom-left status bar of your browser. On mobile: long-press the link — most apps show a preview of the destination URL.

Spot Domain Spoofing Techniques

Phishers use several tricks to make malicious domains look legitimate:

• Typosquatting — registering domains with common typos: “paypa1.com”, “arnazon.com”, “gooogle.com”
• Subdomain spoofing — putting the real brand name as a subdomain: “paypal.com.evil-domain.com” — the actual domain is “evil-domain.com”, not “paypal.com”
• Homograph attacks — using visually similar characters from other alphabets: using a Cyrillic “а” (which looks identical to a Latin “a”) in a domain name
• Hyphen tricks — “pay-pal.com” or “paypal-secure.com”
• Extra words added — “paypal-login-verification.com”, “amazon-account-update.net”

The rule: look at the root domain (the part just before the TLD: .com, .net, .org). Everything to the left is a subdomain; everything to the right of .com is a different TLD. The root domain is the only part that matters for legitimacy.

Real-World Examples of Each Spoofing Technique

Advanced Techniques: Punycode and IDN Homograph Attacks

Modern browsers support Internationalized Domain Names (IDN), which allow non-Latin characters in web addresses. Attackers exploit this by registering domains using characters from other alphabets — Cyrillic, Greek, Armenian — that render as visually identical Latin letters. Behind the scenes, the browser converts this into “Punycode” (a string starting with “xn--“), which is what actually gets registered and resolved.

Most modern browsers now detect suspicious mixed-script domains and display the Punycode form instead of the deceptive rendering, but not all do, and older or less common browsers may still be vulnerable. If a URL in your address bar starts with “xn--“, treat it as a major red flag regardless of what it appears to say.

Suspicious URL Structures

Beyond the domain itself, URL structure reveals intent:

• Unusually long URLs with random strings — legitimate sites use clean, readable URLs; attackers use obfuscated strings to hide malicious parameters
• IP addresses instead of domain names — links pointing to http://192.168.1.1/login instead of a named domain
• HTTP instead of HTTPS for login pages — any legitimate site asking for credentials uses HTTPS
• Shortened URLs — bit.ly and similar services hide the destination; expand them first using a URL expander tool
• Unusual top-level domains — .xyz, .top, .click, .info on a financial or institutional-looking site is a red flag (though not conclusive)

Context Clues in the Message Itself

The link doesn’t arrive in isolation. Evaluate the surrounding context:

• Urgency and threats — “Your account will be suspended in 24 hours” is a manipulation technique, not a legitimate business practice
• Unsolicited contact — Did you initiate this interaction? Legitimate companies don’t send unexpected login prompts
• Mismatched sender — The display name says “PayPal Security” but the actual email address is “[email protected]”
• Grammar and formatting — Not all phishing is poorly written, but awkward phrasing or formatting inconsistencies remain common

Checking Links on Mobile vs. Desktop

On Desktop

Hover over any link without clicking — the real destination appears in the status bar at the bottom of the browser window. In email clients, right-click and choose “Copy Link Address” to inspect the full URL in a text editor before deciding.

On Mobile

Long-press (don’t tap) the link to bring up a preview or a context menu with “Copy Link” or “Open in new tab” options — this reveals the destination without navigating there. Be extra cautious in SMS and messaging apps, where link previews are less consistent and shortened URLs are especially common.

What Legitimate Companies Actually Do (and Don’t Do)

Understanding normal, non-phishing behavior makes anomalies easier to spot:

• Legitimate companies rarely ask you to “verify your account” via an emailed link — they direct you to log in normally through the app or by typing the address yourself
• Banks do not ask for your full password, PIN, or card CVV via email or text under any circumstances
• Real security alerts typically give you more than 24 hours and don’t threaten immediate account closure
• Legitimate shipping and delivery notifications include a real tracking number that matches an order you actually placed

Walkthrough: Evaluating a Real Suspicious Link Step by Step

Say you receive a text: “Your USPS package is on hold. Update your delivery preferences: usps-delivery.info/track82931”. Here’s the actual evaluation process:

1. Root domain check: “usps-delivery.info” is not “usps.com” — the real USPS website. This alone is disqualifying.
2. TLD check: “.info” is an unusual TLD for a US government-affiliated postal service, which uses .com.
3. Context check: Are you actually expecting a package? If not, or if you can’t match it to a real order, that’s a second red flag.
4. Urgency check: “On hold” implying action is needed now is a classic pressure tactic.
5. Verification step: Rather than clicking, go directly to usps.com and track your actual shipments using the real tracking number from your order confirmation email.

Every one of these checks takes seconds once the habit is built, and together they catch the overwhelming majority of phishing attempts without needing any special tools.

Built-In Protections Your Browser and Email Provider Already Offer

You’re not evaluating every link entirely unaided. Chrome, Firefox, Safari, and Edge all use Google Safe Browsing or an equivalent blocklist that blocks known phishing domains automatically, showing a full-page warning before the page even loads. Gmail, Outlook, and most major email providers run incoming mail through phishing detection filters that catch a large share of attempts before they reach your inbox. These systems are good, but not perfect — new phishing domains are registered constantly and there’s always a window between a domain going live and it being added to blocklists. That window is exactly when manual link evaluation matters most.

Common Myths About Spotting Phishing Links

Myth: Phishing Emails Always Have Bad Grammar

This was true a decade ago but is increasingly unreliable. Sophisticated phishing campaigns, including those aided by AI writing tools, now produce error-free, professionally formatted messages indistinguishable from legitimate corporate communication. Grammar is a signal, not a guarantee.

Myth: If My Antivirus Doesn’t Flag It, the Link Is Safe

Antivirus and browser blocklists rely on a domain already being reported and confirmed malicious. Brand-new phishing domains — registered hours before a campaign launches — often aren’t in any blocklist yet. Absence of a warning is not the same as confirmed safety.

Myth: Only Older or Less Tech-Savvy People Fall for Phishing

Security researchers and IT professionals get phished too — spear phishing campaigns are specifically crafted using real information about the target to defeat exactly the skepticism a tech-savvy person would normally apply. Anyone can be targeted with a sufficiently well-researched lure.

Use a Scanner for Links You’re Not Sure About

When you’ve got a link that feels suspicious but you can’t immediately identify why, the Phishing Link Scanner analyzes the URL for phishing indicators — domain patterns, structural red flags, and context signals — giving you a clear verdict and a breakdown of any red flags found. For real-time threat intelligence, also check the link on VirusTotal.com, which queries 70+ security engines.

Building the Habit

The goal isn’t to become suspicious of every link — it’s to build a quick evaluation habit for unexpected or high-stakes links. Routine links from services you regularly use in expected contexts (your bank’s app sending you a notification you initiated) are low risk. Unexpected links arriving via email or text claiming urgent action is needed deserve scrutiny before you click.

If You’re Still Not Sure After Checking

Sometimes a link passes every check above but something still feels off — a slightly unusual request, an unexpected sender, or a message that doesn’t quite match how the organization normally communicates. In that situation, the safest move costs almost nothing: don’t click, and instead navigate directly to the organization’s website or app by typing the address yourself or using a bookmark you saved previously. If there’s a genuine account issue, it will be visible once you log in through the front door. If there isn’t, you’ve avoided a potential compromise for the cost of thirty extra seconds. This same principle applies to phone numbers included in suspicious messages — look up the organization’s real support number independently rather than calling the one provided in the message itself.

Frequently Asked Questions

Q: Is hovering over a link on desktop always reliable?

A: It’s reliable for revealing the actual destination URL, but you still need to read that URL carefully — the destination itself can still be a convincing typosquat or subdomain spoof. Hovering shows you where you’re going; you still have to evaluate whether it’s legitimate.

Q: Can a link be dangerous even with HTTPS and a padlock icon?

A: Yes. HTTPS only confirms the connection is encrypted, not that the site is trustworthy. Anyone can obtain a free SSL certificate for a phishing domain in minutes, so the padlock icon says nothing about the site owner’s intent.

Q: What is Punycode and why does it matter?

A: Punycode is how browsers encode internationalized domain names containing non-Latin characters. Attackers use lookalike characters to create domains that visually match a trusted brand; a URL starting with “xn--” is the browser revealing that disguise.

Q: Are shortened URLs (bit.ly, tinyurl) always dangerous?

A: Not always — many legitimate businesses use them for convenience. But because they hide the real destination, you should expand them with a URL-unshortening tool before clicking, especially if the message itself feels unsolicited or urgent.

Q: What’s the single fastest check I can do before clicking any link?

A: Identify the root domain — the part immediately before .com, .net, .org, etc. — and ask whether it matches the organization the message claims to be from. This one check catches the majority of spoofing techniques.

Related Reading

• Clicked a Phishing Link? What to Do Right Now
• 5 Real Phishing Email Examples and Their Tells
• Smishing vs Phishing vs Vishing: What’s the Difference?
• How to Report a Phishing Email or Website
• Try our free Phishing Link Scanner →