Guide
Checking Suspicious URLs
A careful way to assess a suspicious link: handle it safely, read the domain, follow its redirects without visiting it, check reputation and technical signals, and decide what to do.
Phishing links work because they look ordinary. This guide is for anyone who receives a link they’re unsure about, whether that’s a delivery notice, a login warning or an unexpected invoice, and wants to check it without putting themselves at risk.
1. Handle the link safely
Don’t click it. Right-click or long-press to copy the address instead. On a phone, pressing and holding a link usually shows the full address without opening it.
If the message claims to come from a company you use, the safest check is not to use the link at all: open the company’s app or type its address yourself.
2. Read the domain carefully
The part that matters is the domain just before the first single slash. Attackers put trusted names in subdomains (paypal.example-login.com belongs to example-login.com), swap letters for look-alikes, or use a slightly different ending. Read it right to left from the first slash.
3. Follow the redirects without visiting
Shortened and tracking links hide the real destination. A redirect checker follows the chain from a server and shows where it ends, so you can see whether a “bank” link actually lands on the bank’s domain.
4. Check reputation and technical signals
Look the address up on a reputation service such as Google Safe Browsing’s site status page. A match in a reputation list is a strong reason to stop. Remember that a clean result only means nothing has been reported yet; new phishing sites often aren’t listed for hours.
Then run the URL through the Website Trust Inspector (it needs a free account). It doesn’t check reputation lists, but it shows technical warning signs worth taking seriously, such as a redirect to an unrelated domain, a drop from HTTPS to plain HTTP, or a hostname written with look-alike international characters.
5. Decide and report
If anything looks wrong, don’t enter details. Report phishing to your email provider and, if it imitates a company, to that company. If you already entered a password, change it on the real site straight away and turn on two-factor authentication.