How to check a suspicious link without opening it

A link on its own is just text. It can be written one way and point somewhere completely different, and most people only find out where it leads by tapping it — which is exactly the moment a phishing page is waiting for. Almost everything you need to judge a link can be gathered without loading it. This guide walks through that in order, from the one-second checks to the more careful steps worth taking when something still feels wrong.

1. Read the link itself

Before reaching for any tool, look at the address properly. On a computer, hover the pointer over the link and read the real URL in the status bar at the bottom of the window. On a phone, press and hold the link until a preview card appears, then read the address without releasing your finger on the link. In an email, the blue text you see is just a label — it can say www.your-bank.com while the underlying link points anywhere, so always check the address the label actually carries rather than the words on screen. Be aware too that some mobile browsers show only the first part of a long address; if you cannot see the whole thing, copy the link and paste it somewhere you can read it in full.

The part that matters is the registrable domain: the name and ending immediately before the first single slash. Inhttps://accounts.google.com/signinthat is google.com. Scammers bury a trusted name where it has no authority:google.com.secure-login-check.ruis on secure-login-check.ru, not Google. Watch for a real brand used only as a subdomain, hyphenated add-ons like -supportor -verify, and endings that do not fit the company — a high-street bank does not operate from .top or.xyz. Other tells in the raw address: an @symbol (everything before it is ignored by the browser), a label startingxn-- (a disguised non-Latin character), or a bare number such ashttp://192.0.2.10/logininstead of a name. The part after the domain matters less, but a path that crams in a brand name and a scary word — /paypal-account-locked-verify-now — is a sign the domain itself has nothing legitimate to say.

2. Reveal where a short link goes

Shortened links — bit.ly,t.co,tinyurl.com and dozens more — show you nothing about the destination, and you should not open one to find out. Several shorteners have a built-in preview: with many bit.ly links you can add a + to the end, and TinyURL accepts apreview. prefix, to see the target on the shortener's own page rather than being forwarded. Where that is not available, paste the short link into a link expander or a URL safety checker — including the one on this site — which follows the redirect chain for you and reports the final address without your device ever connecting to it. A short link that resolves to a different brand than the message implies, or to yet another shortener, is a reason to stop. To hand the link to a tool safely, copy it rather than open it: right-click and choose "Copy link address" on a computer, or long-press and choose "Copy" on a phone.

3. Run the address through a link checker

A URL safety checker compares the address — and where it ends up — against large, continuously updated records of sites reported for phishing, malware and fraud, then returns a plain safe, suspicious or unsafe reading. It does not open the page in your session. This is the single most useful check for a link you were not expecting, because it catches known-bad sites that look completely ordinary in the address bar. A result of unsafe means walk away.Suspicious means something is off but not proven — slow down and confirm another way. If you expanded a shortener in the previous step, check the destination address it resolved to as well, not just the short link. Keep the tool's limit in mind: a brand-new scam page that nobody has reported yet can still come back clean, so a good result lowers the odds without removing them.

4. Check how old the domain is

Most phishing pages and fake shops are run from domains registered days or weeks earlier and abandoned soon after. A quick registration-date lookup — any WHOIS or RDAP tool shows a "created" date — is a strong signal. A bank, tax office or delivery "notice" pointing at a domain registered last Tuesday is almost certainly fraudulent, however polished the page looks. A domain that has existed for years is not automatically safe, but it clears one of the more reliable red flags.

5. Weigh the message it arrived with

The link never comes alone. Ask who sent it and whether you were expecting it. Check the sender's real address or number, not the display name — "Netflix Support" is a label anyone can set, and a genuine-looking name over an unrelated address is a giveaway. Does the visible link text match the real destination you saw when you hovered? Is there pressure — a deadline, a threatened account closure, a small fee to release a parcel? Does it want you to "confirm", "verify" or "reactivate" something through the link rather than through an app you already have? Real organisations do send links, but they rarely depend on you clicking one to keep your account open. If the wording is doing the work of rushing you, treat the link as suspect whatever the other checks say.

6. If you must load it, keep it contained

Sometimes you genuinely need to see the page. Do it on your terms. The safest version is to ignore the link entirely and reach the site yourself: type an address you already know, or open the official app. If you must open the specific link, use a device that holds nothing valuable, or a browser profile with no saved logins, and stop at looking. Never type a password, card number or one-time code into a page you reached from a link you were unsure about — entering details is the step that turns a risky page into a stolen account.

A 30-second routine

1. Reveal the true address — hover on desktop, long-press on mobile — and read the domain right before the first single slash.
2. Expand any shortener with its preview feature or a checker, never by opening it.
3. Run the address through a URL safety checker.
4. Read the surrounding message for urgency and for a mismatch between what it says and where it points.
5. Still unsure? Reach the organisation the way you normally would and leave the link alone.

What not to do

Do not forward a suspicious link into a group chat to ask what people think — that only widens the target. Do not paste a link containing a login token, a password-reset code or personal details into a public checker; check the site's main domain instead, for exampleexample.comrather thanexample.com/reset?token=abc123. And do not treat "it opened fine and looked normal" as proof of safety: a convincing copy of a real login screen is the entire point of a phishing page.