How to read a URL before you click it
Phishing works because a URL is read the way people read prose — left to right, first familiar word wins. Browsers do not read them that way, and the gap between the two is where the entire technique lives.
There is one rule that resolves most of it, and five tricks that survive it.
The rule: find the registrable domain
In any URL, locate the first single slash after the
://. Everything before it is the host. Then read that host
right to left. The last two labels — or three, for suffixes like
.co.uk — are the registrable domain, and that is the only part
that says who controls the site.
https://www.paypal.com.account-verify.example.ru/login
^^^^^^^^^^
the domain is example.ru
Everything to the left of example.ru is a subdomain, and subdomains
are free. Anyone owning example.ru can create
www.paypal.com.account-verify.example.ru in seconds. The word
"paypal.com" appearing in the host means nothing whatsoever.
Once you read right to left, most phishing URLs collapse immediately.
Trick 1: the @ sign
https://[email protected]/login
In a URL, anything between :// and an @ is userinfo, not
a hostname. The browser connects to malicious.example. The
Microsoft-looking part is discarded. Modern browsers warn about this, but it
still renders convincingly in email clients and chat apps.
Trick 2: look-alike characters
Some characters from other scripts are visually identical to Latin ones. A
Cyrillic "а" renders the same as an ASCII "a" and is a completely different
character, so pаypal.com can be registered by someone else entirely.
Browsers defend against this by displaying such domains in Punycode —
the domain appears as something beginning xn--. If a familiar brand's
address suddenly looks like xn--pypal-4ve.com, that is the defence
working, not a rendering bug.
Plain ASCII substitution is more common and needs no clever encoding at all:
rn for m, 1 for l, 0 for
o. In many fonts rnicrosoft.com is very hard to catch.
Trick 3: the padlock means nothing about honesty
HTTPS means the connection is encrypted and the certificate matches the domain you are visiting. It does not mean the site is legitimate. Certificates are free and issued in under a minute, and the large majority of phishing pages now serve over HTTPS.
The padlock tells you nobody is reading your traffic on the way to the attacker.
Trick 4: shorteners and redirect chains
A shortened link hides the destination entirely. Worse, a chain can route through a legitimate domain first — an open redirect on a real site, or a marketing click tracker — so the first hop looks trustworthy and the last one is the phishing page.
The destination is what matters, and you cannot see it without following the chain. Do that somewhere other than your own browser.
Trick 5: a domain registered yesterday
Phishing domains are usually days old. Legitimate brands are years old. Domain age alone does not prove anything — every legitimate site is new once — but a domain impersonating a well-known brand and registered last Tuesday is close to conclusive.
The context that matters more than the URL
Most successful phishing is not caught by URL inspection. It is caught by noticing the situation is wrong:
- The message creates urgency — an account closing, a payment failing, a delivery about to be returned.
- It arrived unprompted and asks you to authenticate.
- The display name is someone you know but the actual address, or the
Reply-To, is unrelated. - It asks for a credential, a code, or a payment change.
A multi-factor prompt you did not trigger is a signal in itself: someone has your password already.
If you think you already clicked
- If you entered a password, change it now — and anywhere you reused it.
- If you approved an MFA prompt, treat the account as compromised and revoke active sessions.
- Check the account's forwarding rules. Adding a hidden rule that forwards everything is a standard first move after a mailbox takeover.
- Tell whoever handles security where you work. The delay in reporting does more damage than the click.
The safest way to reach any account is the one that does not involve the link: type the address yourself, or use the app.
The Phishing URL Checker follows the redirect chain on our servers rather than in your browser, so you see the final destination, the registrable domain, look-alike indicators and how long the domain has existed — without visiting the page yourself.