To avoid dangerous links online, you need to preview every link before clicking, inspect the true destination domain, use link-checking tools for suspicious URLs, and stay alert for red flags like misspelled domains, urgency tactics, and unexpected messages.
You’re scrolling through your inbox or social media feed, and a message catches your eye—your bank needs you to verify your account, a package is waiting for delivery, or a colleague shared an important document. The link looks legitimate. But one click could lead to a fake login page designed to steal your password, or trigger a malware download that compromises your device.
In this guide, you’ll learn practical, proven techniques to spot dangerous links before you click them, how to use safety tools effectively, and what to do if you accidentally click something suspicious.
TL;DR
Check every link before you click it by hovering (desktop) or pressing and holding (mobile) to reveal the true destination. Read the domain name carefully—the real domain is the last part before the first slash. Watch for misspellings, lookalike characters, and unusual top-level domains like .xyz or .cc. Shortened URLs hide the destination completely; expand them with a link checker before visiting. Never trust a link just because it has HTTPS—about 80% of phishing sites now use it. If you’re unsure, use a link-scanning tool or go directly to the website by typing the address yourself. The FBI’s 2025 Internet Crime Report recorded over 1 million complaints of suspected internet crime with reported losses exceeding $20 billion, making link safety more important than ever.
Key Takeaways
- Hover before you click—on desktop, hover your mouse over any link to see the true destination URL in the bottom-left corner of your browser or email app.
- Read domains right-to-left—the real domain is the last part before the first slash. In login.microsoft.com.account-verify.ru, the real domain is account-verify.ru, not Microsoft.
- Watch for lookalike domains—scammers use misspellings like amaz0n.com instead of amazon.com, or add extra words like amazon-security-check.com.
- Be suspicious of urgency—messages that demand immediate action (“Your account will be locked”) are classic phishing tactics designed to bypass your caution.
- Use link checking tools—services like Malwarebytes Scam Guard, UrlScan.io, and browser extensions like Unsitely can scan links for threats before you visit them.
How to Check a Link Before You Click
On Desktop: The Hover Test
This is your first and most important defense. Move your mouse pointer over the link—without clicking—and look at the bottom-left corner of your browser window or email client. The true destination URL will appear there.
For example, a link that says “Sign in to Microsoft” might actually point to a random domain filled with numbers or misspellings. The hover test exposes this immediately.
On Mobile: Press and Hold
Mobile devices don’t have a hover function, but you can still preview links. Press and hold the link instead of tapping it. A preview will appear showing the full URL. You can also choose “Copy link” and paste it into a note to read the address carefully before deciding whether to open it.
Pro tip: Some apps show preview cards that encourage quick tapping. Slow down and inspect the actual domain before you click.
Read the Domain Correctly
The most important part of any URL is the domain name—the part just before the first single slash. Here’s how to read it correctly:
- login.microsoft.com/account → the domain is microsoft.com (legitimate)
- microsoft.com.account-verify.ru/login → the domain is account-verify.ru (not Microsoft—this is a trap)
Attackers frequently register domains that look like legitimate ones but aren’t. Watch for subtle misspellings like examp1e.com (with a numeral one instead of the letter “l”) or extra words attached to a familiar name.
Red Flags to Watch For
Before you click any link, scan for these warning signs:
| Red Flag | What It Looks Like | Why It’s Dangerous |
|---|---|---|
| Misspelled domains | amaz0n.com, micros0ft.com, g00gle.com | Attackers use lookalike domains to impersonate trusted brands |
| Unusual TLDs | .xyz, .top, .cc, .click instead of .com or .org | These extensions are cheaper and more often associated with malicious activity |
| Extra words before the brand | secure-login-bank-example.com | Attackers add words to make the domain look legitimate while owning it themselves |
| Shortened URLs | bit.ly/abc123, t.co/xyz789 | These hide the true destination completely—you can’t tell where they lead without expanding them first |
| Urgency or fear tactics | “Your account will be locked!”, “Immediate action required” | Pressure tactics are designed to make you click before you think |
| Unexpected source | Links from unknown senders or familiar contacts behaving unusually | Attackers often compromise legitimate accounts and send malicious links from trusted email addresses |
Be especially cautious of links that end in unusual domains such as .NET, .XYZ, and .CC, as these are often associated with malicious activities.
Using Link Checking Tools
When you can’t determine a link’s safety by inspection alone, use a dedicated tool to scan it.
Online Link Checkers
UrlScan.io is a free service that analyzes URLs for potential security threats. It examines the destination’s structure, behavior, and domain age to assess safety. You can even use it with Microsoft Security Copilot through an API integration.
Malwarebytes Scam Guard lets you safely analyze suspicious links without visiting the destination page. It checks for known malware, scams, phishing indicators, and suspicious behavior.
Browser Extensions
Browser extensions provide real-time protection as you browse:
- Unsitely—a Firefox extension that scans any website in seconds and displays a trust score (🟢 Safe, 🟡 Suspicious, 🔴 Dangerous). It also automatically resolves shortened URLs and shows safety chips next to links on every page.
- Criminal IP—a Chrome extension that automatically scans and blocks malicious domains based on threat intelligence from Criminal IP’s Domain Search, which provides daily lists of malicious and phishing URLs.
URL Expansion for Shortened Links
Shortened URLs from services like bit.ly or t.co hide the destination completely. Don’t click a shortened link from a source you don’t trust. If you must check one, use a link-expander or URL-scanner service that reveals the true destination without you visiting it first.
Real-Time Scanning
Free tools typically scan links only once, making them blind to delayed changes. More advanced, real-time scanning tools check links every time they’re clicked, detecting when a once-safe link becomes dangerous—a tactic known as “Legacy Reputation URL Evasion” (LURE).
Security tools that check links every time they’re opened can help. And if a link suddenly asks for a password when it didn’t before, that could be a warning sign of something suspicious.
What Makes a Link Dangerous?
A link becomes dangerous when it directs you to a destination designed to harm you—whether through stealing your credentials, downloading malware to your device, or tricking you into revealing sensitive information.
Cybercriminals create malicious links for several purposes:
- Fake login pages—capture your username and password when you attempt to sign in
- Malware downloads—install ransomware, spyware, or viruses
- Browser exploits—take advantage of vulnerabilities in your browser or device
- Fraudulent transactions—trick you into paying for fake products or services
What makes modern phishing links particularly effective is their sophistication. Attackers study legitimate communications from the brands they impersonate, replicating logos, formatting, and language patterns with remarkable accuracy. The link itself often represents the only detectable flaw in an otherwise convincing message.
The LURE Threat: Links That Change
One of the smarter scams today is called Legacy Reputation URL Evasion (LURE). In this tactic, a scammer sends a link that points to a popular and trusted website, like a file-sharing or storage service. At first, the link opens a clean page—maybe a simple document or a blank file. Since the website is well-known, most filters and antivirus tools don’t block it. But after some time, the scammer changes what’s behind the link, switching it to a fake website or a page that tricks people into typing in their personal information.
This works because many security systems only check a link once, when it’s first seen. They don’t keep checking the link every time it’s clicked. The link hasn’t changed in appearance—it still shows the same web address. However, the content behind it has been quietly replaced.
For example, a bank employee might receive a link to a file stored in a cloud service. When they open it the first time, it shows a normal document, so it appears safe. Later, when they click the same link again, it leads to a fake login page that looks just like their company’s official system. If they type in their username and password, that information is sent to the scammer.
Don’t Trust the Padlock
HTTPS (the padlock icon) only means the connection is encrypted—not that the site is honest or legitimate. Around 80% of phishing sites now use HTTPS, precisely because people were taught to look for the padlock as a sign of safety. Treat the padlock as the bare minimum, never as a green light.
What to Do Instead of Clicking
When you’re unsure about a link, use these safer alternatives:
- Go directly to the website—type the address yourself into your browser rather than clicking a link from a message.
- Use bookmarks—save bookmarks for banking, email, cloud storage, and work tools so you always navigate through a trusted path.
- Open official apps—instead of clicking links in messages, open the official app for the service.
- Report suspicious messages—if you receive a suspicious email or text, report it to the company being impersonated.
- Delete the message—if you can’t verify the message’s legitimacy, delete it.
If a link claims to be from your bank, courier, or employer, the safest move is to ignore the link and reach the organisation independently—type their address or open their app. This one habit defeats most phishing attempts.
What to Do If You Click a Suspicious Link
Clicking a suspicious link doesn’t automatically mean you’ve been compromised, but you need to take immediate action:
- Stop interacting with the page—do not enter any passwords, credit card details, personal information, or download any files.
- Close the tab immediately—if the page appears suspicious, close the browser tab without interacting further.
- Report what happened—if it was a work email or link, report it to your IT or security team immediately. Share the original message, link, and any actions you took.
- Reset passwords if you entered any—change your passwords from a trusted device (not the one you clicked the link on) and revoke active sessions for any accounts you may have exposed.
- Run a security scan—use your antivirus or security software to scan for any malware that may have been downloaded.
The median person clicks a phishing link about 21 seconds after a message arrives, so slowing down and checking before clicking is your best defense.
Frequently Asked Questions
How can I tell if a link is safe to click?
Hover over the link (desktop) or press and hold it (mobile) to preview the true destination URL. Read the domain carefully—misspellings, extra words, and unusual top-level domains (like .xyz or .cc) are red flags. If you’re still unsure, use a link checker tool to scan the URL before visiting.
Is a link safe if it has HTTPS and a padlock icon?
No. The padlock only means the connection is encrypted—it doesn’t mean the website is legitimate. Around 80% of phishing sites now use HTTPS, so don’t treat the padlock as proof of safety.
Are shortened URLs dangerous?
Shortened URLs (from bit.ly, t.co, tinyurl.com, etc.) hide the true destination completely. They can be used by legitimate marketers and attackers alike. Never click a shortened link from an untrusted source. If you must check one, use a link-expander or URL-scanner service first.
What should I do if I accidentally click a phishing link?
Close the tab immediately, do not enter any information, and if you entered credentials, change your passwords from a trusted device immediately. Report the incident to your security team or IT if it happened on a work device.
Can a link be dangerous even if it looks like it’s from someone I know?
Yes. Attackers often compromise legitimate email accounts or impersonate known contacts to send malicious links. The message might look normal, but the link itself could be the only clue—so always inspect it before clicking.
Sources
- Malwarebytes — How to Check if a Link Is Safe
- Total Defense — Hover Before You Click
- SafeToOpen — How to Check if a Link Is Safe
- Unsitely — Website Safety Scanner (Firefox Add-on)
- Microsoft Learn — UrlScan Overview
- The Morning — Police Warn Public on Suspicious Links
- PNP ACG — LURE Cyber Security Bulletin
- Criminal IP — Daily Malicious URL Repository
Have a link safety scenario you’d like help with? Drop your question in the comments—awareness is your first and best defense online.
