Don't Click Blindly: How to Check a Suspicious Link Before You Click
The Anatomy of Deception
Clicking a single malicious link can lead to device infection or browser session cookie theft. Attackers use three main tactics to get you to click.
1. Typosquatting
It looks like the real site, but one letter is changed. The brain automatically reads the familiar word, ignoring the mistake.
- Fake:
netflix-support.com(official is only netflix.com) - Substitution:
paypaI.com(capital "i" instead of lowercase "L") - Homograph:
аррle.com(uses Cyrillic letters)
2. URL Shorteners
Services like bit.ly or t.co are frequently used to mask the final destination. You never know where a short link leads until you click it.
3. Open Redirects
Hackers find a vulnerability on a trusted site (e.g., a government domain) and craft a link that goes to the trusted site first, then silently redirects to a malicious one.
The Golden Rule: Verify Before You Click
If a link comes from a stranger, or from a friend but with unusual text (e.g., "Look who is in this photo!"), never click it directly.
- On a computer: hover your cursor over the link without clicking and look at the bottom left corner of your browser — the real URL will appear there.
- On a phone: long-press the link to copy it instead of opening it.
Tools for Checking
To see if a link is safe, use scanners. UrusMail features a built-in link checker that queries antivirus databases.
The tool analyzes the URL for malware, phishing scripts, and shows exactly where the link leads (unrolling short links and redirects). If the scanner flags the site as suspicious — just delete the message.