How to Check a Suspicious Link Without Opening It
Updated:
A link can contain a familiar brand name without belonging to that brand. Inspect the address as text and verify the request before opening an unfamiliar destination.
Read the destination, not just the label
An email or message can display one piece of text while its link points somewhere else. If your app offers a link preview, inspect that destination without opening it. On a device where you cannot confidently preview it, open the organization's known app or website separately.
Try one free homepage check for an explained second opinion. Start with one of the fictional examples below. A check is not a reason to open a link that you otherwise have good reason to distrust.
Four fictional addresses to compare
These .example addresses are illustrations, not real services. Read them as text rather than trying to visit them.
- bank.example.security-review.example/login — the bank-like words are part of a longer hostname. They do not make this a page at bank.example.
- security-review.example/bank.example/login — the familiar name is in the path. A word after the hostname does not establish ownership of the site.
- security-review.example/?continue=bank.example — text in a query parameter can describe anything. It does not change which host receives the initial request.
- bannk.example/login — an extra letter can be easy to overlook. Compare the whole address with a known source rather than relying on its overall appearance.
The examples show why a domain-looking word can be misleading. They do not classify every similar-looking real address as malicious.
Why the last-two-label rule is unreliable
The registration boundary is not always the last two pieces of a hostname. Some public suffixes contain more than one label, such as co.uk. The Public Suffix List documents these boundaries for software.
That list does not determine whether a website is honest or safe. A registered domain can host harmful content, and a legitimate domain can be compromised. When a name is unfamiliar or ambiguous, verify it through an independent known source.
HTTPS describes the connection
An encrypted connection protects information in transit between your browser and a site. It does not establish that the site's operator is the company you intended to contact. Chrome's own guidance says to check the site name even on a secure connection.
Follow browser security warnings. Do not interpret the absence of a warning as proof that a site is trustworthy.
Short links and private links need extra care
A short link can hide a destination. Without a trustworthy preview, use an independent route to the service instead. Expanding or checking a link may contact external services; it is not necessarily a purely local action.
Avoid submitting password-reset links, private file-sharing links or URLs containing access tokens to a public checker. A URL can contain sensitive information even when it looks like ordinary text.
Where ScamsShield helps
ScamsShield can review a suspicious link and explain possible warning signs. A result is an assessment of the submitted content, not a guarantee about a site or every future redirect. It may miss a problem or flag something legitimate.
Try a fictional example in the homepage checker, or read the phishing email guide. Online checks require an account. A free account offers checks within the displayed limits. Review data handling before submitting a private link.
Frequently asked questions
Does HTTPS prove that a website is legitimate?
No. HTTPS secures the connection to a site; it does not establish that the operator is the organization you intended to contact.
Is the registered domain always the last two labels?
No. Public suffixes can include multiple labels, such as co.uk. Registration boundaries and a site's trustworthiness are separate questions.
Should I paste a password-reset link into a checker?
Avoid submitting private links or URLs containing access tokens. Open the relevant service independently and use its official account options.
Sources and review
Reviewed on 25 October 2026. Published by ScamsShield, the provider of the tools linked above. These sources are references, not endorsements of ScamsShield.