How to read a link before you click it

Most phishing links look believable at a glance. The good news is that reading a web address correctly takes about two seconds once you know where to look. This guide shows you where, the five tricks to watch for, and a quick routine you can use on any link.

The parts of a link

Take this address:

https://login.shop.example-store.com/offers/today?id=42

• https:// is the start. It only says how the connection is made.
• login.shop are subdomains. Anyone who owns a domain can create any subdomains they like.
• example-store.com is the domain. This is the part that tells you who really owns the site.
• /offers/today?id=42 is the path. It can say anything and proves nothing.

Read from the first single slash, back to the left

The real site is the name that sits just before the first single /, plus its ending (.com, .in, and so on). Everything to the left of that name, separated by dots, can be made up.

So in https://example-bank.com.verify-account.xyz/login, the site is verify-account.xyz. The words example-bank.com are just a decoy at the front.

Try it on the made-up address from our fake restaurant offer example: brandname-offers.co.in/wednesday. The site is brandname-offers.co.in. It contains a brand’s name, but it is a different website.

Five tricks to know

1. The lookalike. An address that copies a real one with a letter swapped (rn instead of m, a zero instead of an o) or with extra words, such as bank-secure-login.example. Having a brand’s name in an address does not make it the brand.
2. The @ trick. In https://google.com@evil.example/login, everything before the @ is ignored. The real destination is evil.example.
3. The shortened link. Links from services like bit.ly hide where they lead until you open them.
4. Special characters. Some letters from other alphabets look identical to Latin ones, so a name can look right and still be a different site.
5. The long address. A very long address, or one with many dots and hyphens, can bury the real name where you will not look.

Why a phone makes it harder

On a phone, browsers and messaging apps often show only the start of an address, or hide it behind a button or a preview. That is why the same trick that you would spot on a laptop slips past on a small screen. Where you can, press and hold a link to see the full address before you open it, or paste it somewhere you can read it.

The padlock does not mean safe

The padlock beside an address only means the connection between you and the site is encrypted. Anyone can get one for any site, including a scam site. It tells you nothing about who owns the site or whether it is honest.

A two-second check

1. Find the first single slash.
2. Read the name just before it, with its ending. Is it exactly the company you expect?
3. Look for extra words, hyphens, or a shortened link.
4. Does the message rush you? That alone is a reason to slow down.

Let a checker read it for you

Reading addresses is a skill, and it is easy to miss something on a phone. When you are not sure, paste the link into the RIEG link checker. It does not open the link on your device. It shows the address as plain text with the real website in bold, lists anything unusual in how the address is written, and gives its result. There is a step-by-step guide in how to check a link with RIEG.

A checker is a second pair of eyes, not a guarantee. If a message rushes you or asks for a password or an OTP, stop and check with the sender another way.

Where this fits

Reading a link is one habit within a larger one: slow down, and go to the official source yourself. For the bigger picture, read what phishing is and how it works.