Is this link safe? How to check a link before you click

You can't tell if a link is safe just by looking at the message, but you can check it in a minute without opening it. Find the real domain in the address, expand it first if it's a short link, and ask whether that domain really belongs to whoever the message claims to be. If anything doesn't match, don't open it: go to the site by typing its address yourself.

How to read a link: find the real domain

A web address, or URL, has several parts. In https://login.yourbank.com/account, the part after https:// is the name of the site, and everything after the next slash is a page inside it. Only the name tells you whose site it is, and inside the name, only the domain: the part the owner registered.

1. Look at the text after https:// and before the next single /. Anything after that slash can say whatever the sender wants, including your bank's name.
2. Read that part from right to left. The last piece is the ending, like .com. The word just before it completes the domain: yourbank.com. With two-piece country endings like .com.co, take three: tubanco.com.co.
3. Anything further left is a subdomain, which the owner can set to anything, so it proves nothing.

Scammers exploit exactly this:

Link	Real domain	The trick
https://yourbank.com.account-update-7.net/	account-update-7.net	"yourbank.com" is only a subdomain
https://yourbank-com.help/	yourbank-com.help	A hyphen makes it a different name
https://yourbank.com@example.net/	example.net	Everything before an @ is ignored

Look-alike letters and punycode

Some fake domains only look right: rn can pass for m, a zero for an o, a lowercase l for a capital I. A subtler trick uses other alphabets. The Cyrillic "а" looks identical to the Latin "a", but to your browser it's a different character, so it's a different domain.

Domains with accents or non-Latin letters are stored in punycode, a plain-ASCII form that starts with xn--. If you see xn-- in an address and the brand you expected doesn't use accents or another alphabet, stop. Browsers often show the xn-- form when a name mixes alphabets, but not always.

Paste the link into the lookalike domain checker. It runs in your browser and sends nothing. It shows the punycode form and every character from another alphabet. A green result only means no look-alike characters were found; it doesn't prove the site is the real one.

http, https and the padlock

https means the connection is encrypted: other people on the same Wi-Fi can't read or change what you send. It says nothing about who runs the site. The certificates behind https are free and issued automatically, so most phishing sites (fake pages built to steal logins or money) have one too. The padlock means "private connection", not "honest site". Google Chrome replaced its padlock with a neutral icon in 2023, partly because so many people read it as a sign of trust.

Plain http is worse: nothing is encrypted, and browsers label it "Not secure". Never type a password or card number on a page that starts with http://.

Short links: expand them before you open them

Short links from services like bit.ly, t.co or TinyURL hide the destination behind a code. They're usually harmless but hide your best clue. Many also pass through redirects, where one address sends you on to another.

1. Copy the link without opening it: long-press it on your phone, or right-click it on a computer and choose "Copy link".
2. Paste it into the short link expander and press Unroll. The link goes to our server (api.ethorns.com), which follows each redirect for you, so your device never visits it. Only the result is kept, for one hour.
3. Find the real domain of the final address. The tool also warns if the final page isn't https, uses punycode, is a bare IP address (numbers instead of a name), or took many redirects.
4. If the final address is long and full of utm_source or fbclid, paste it into the link cleaner. It strips those tracking parameters, tags that record where you clicked, in your browser and without sending the link anywhere, so it's easier to read.

Check how old the domain is

Scam sites usually live on domains registered days or hours before the message reaches you, because they get reported and blocked quickly. A bank or a shop has normally used the same domain for years, and the registration date is public.

1. Take only the domain: yourbank.com, not login.yourbank.com.
2. Type it into the domain age checker. The domain goes to our server (api.ethorns.com), which asks the official registry through RDAP, the modern replacement for WHOIS (the public record of when a domain was registered). Only the result is kept, for one hour, and no personal data is shown.
3. Read the date. The tool warns strongly under a week and mildly under a month. A brand-new "bank" is a strong warning sign.

An old domain isn't proof of safety, since real sites sometimes get hacked. Some country registries, including .co, don't offer RDAP yet, so no date appears. That alone isn't a bad sign.

Read the message, not just the link

Most dangerous links come with a message written to make you act before you think. Look for:

• Urgency or threats: "your account will be closed in 24 hours", "last notice".
• Prizes and easy money: you won a phone, a refund is waiting, a job that pays a lot for little work.
• "Verify your account": real companies rarely ask you to fix a problem by logging in from a link.
• Things that don't fit: a delivery you weren't expecting, a sender that says "your bank" from an unknown number.
• Requests for codes: nobody legitimate asks for the one-time code they sent you by SMS.

The safest habit: if a message asks you to log in or pay, don't use its link. Open the official app, or type the address yourself.

If you already clicked or typed a password

Opening a link is rarely a disaster by itself. What matters is what you did next.

1. If you only opened the page, close it. If a file downloaded, delete it without opening it.
2. If you typed a password, change it now on the real site, typing the address yourself. Change it anywhere else you reused it.
3. Turn on two-step verification, so a password alone is no longer enough to get in.
4. If you entered card or bank details, call your bank on the number printed on your card and ask them to block it. Never use a number from the message.
5. Check for sign-ins or devices you don't recognize, sign out other sessions, and look for email forwarding rules you didn't create.
6. Report the message as phishing, and warn your contacts if it came from your account.

To see whether a password has already leaked, read has my password leaked?

Quick checklist

• I found the real domain, reading from right to left before the first single slash.
• It's exactly the domain I expected: no lookalike letters, no xn--, no subdomain trick.
• I expanded any short link first.
• The domain isn't brand-new.
• The message isn't pushing urgency, prizes or "verify your account".
• For logins and payments, I went to the site myself.

Frequently asked questions

Can a link infect my phone just by opening it?

It's possible but rare. Those attacks need security flaws that haven't been fixed yet, so keeping your phone and browser updated is the main defense. The usual danger is what the page asks you to do next: type a password, pay, or install something.

If a link has https and a padlock, is it safe?

No. The padlock only means the connection is encrypted, and scam sites get the same free certificates as everyone else. What matters is whether the domain is the one you expected.

Is it safe to expand a suspicious link with eThorns?

Yes. Our server follows the redirects, not your device, and only reads the headers and a small part of the page. Nothing is executed, and links are not saved.

A friend sent me the link. Can I trust it?

Not automatically. Hacked accounts are often used to message every contact. If it seems unusual, ask them another way first, like a phone call.

Try it

• 1.4Short link expanderSee where a short link (bit.ly, t.co, tinyurl…) really goes before you click it: every redirect, the final URL and warning signs.
• 1.7Lookalike domain detectorCheck a link or domain for look-alike tricks: letters from other alphabets, digits for letters, a hidden real domain.
• 1.12Link cleanerStrip utm_, fbclid, gclid, si and other tracking parameters from links before you share them.
• 1.8Domain age checkerSee when a domain was registered, when it expires, its registrar and nameservers.

For your team

• US$19Phishing awareness kit for small businessesA 30-minute session on fake messages, ready to give to your team: a facilitator guide, 12 example messages, a poster, a policy and a quiz.