How-to Guides Security

How to Analyze a Suspicious Link Safely

Inspect a link you do not trust without opening it: defang it, read its real host, spot lookalike characters, expand shorteners and follow the redirects.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page
On this page

Steps

  1. Do not click it; copy the address

    On a computer, right-click the link and choose to copy the link address. On a phone, press and hold the link. Do not rely on the text shown in the message, which can say one thing and link to another.

  2. Defang it before you share it

    Paste the address into the URL Defanger. It turns https:// into hxxps:// and dots into [.] so chat apps and email clients cannot make it clickable. Use that version in tickets and reports.

  3. Find the real host

    Paste the original into the URL Parser and read the hostname. The real site is the last part of the host before the first single /, not the first word. In https://mybank.com.secure-login.example/verify the host is mybank.com.secure-login.example, which belongs to secure-login.example, not to a bank.

  4. Look for lookalike characters

    Run the host through the Hostname to Punycode Converter. If it contains letters from another alphabet, the converted form starts with xn--. For example аpple.com with a Cyrillic first letter becomes xn--pple-43d.com, which is not Apple's domain.

  5. Expand shortened links

    For bit.ly-style links, paste the address into the Short URL Expander. It follows up to 15 redirects and shows the final destination and number of hops, without loading the page in your browser.

  6. Trace the redirect chain

    For any other link, use the HTTP Redirect Chain Tracer to list each hop and its status code (301, 302, 307, 308). A phishing link often bounces through a legitimate-looking tracking host before reaching the fake page.

  7. Decode hidden parts

    Long query strings are often percent-encoded, for example next=%2Faccount. Paste them into the URL Decode to read the real values, and check whether another URL is hidden inside a parameter.

  8. Decide, report and keep it defanged

    If any step looks wrong, do not visit the link. Report it to your security team or mail provider using the defanged form. Only refang it, in a sandbox, if you have a reason to open it.

What you need

The link itself, copied rather than clicked, and the context it arrived in (who sent it, and whether you expected it).

Reading a URL from the right place

Every URL has the shape scheme://host/path?query#fragment. The host is the part that decides which organisation controls the page, and it is easy to be misled by what comes before it.

URL Real host What it really is
https://mybank.com.secure-login.example/verify mybank.com.secure-login.example A page on secure-login.example
https://[email protected]/login evil.example Everything before @ is a username, ignored for routing
https://secure-login.example/mybank.com secure-login.example mybank.com is only a path

Warning signs

  • A host that mixes a brand name with extra words or hyphens, such as mybank-support-verify.example.
  • A domain written with characters from another alphabet. Punycode (xn--) exposes these.
  • A link shortener or a redirect that hides the final destination.
  • A long chain of redirects through unrelated hosts.
  • An unexpected message that creates urgency or asks for a password, payment or code.

Common pitfalls

  • Judging by the visible text. The text of a link and its destination are independent.
  • Trusting the padlock. HTTPS only means the connection is encrypted; phishing sites routinely have valid certificates.
  • Refanging too early. Restore a defanged link only when you must open it, and do so in an isolated environment.

Going further

For the structure of URLs and query strings see How URLs and Query Strings Work, and for how this technique is used in practice, Phishing explains the attack itself.

Try these tools

URL Defanger

Defang URLs, domains, IP addresses and email addresses (hxxp://example[.]com) so they cannot be clicked by accident.

URL Parser

Paste any URL and instantly see its protocol, host, port, path, query parameters, and hash broken down into readable parts.

URL Decode

Decode percent-encoded (URL-encoded) text back into its original readable form instantly in your browser.

Short URL Expander

Resolve a shortened URL (bit.ly, t.co, tinyurl, and more) to its final destination server-side before clicking it.

HTTP Redirect Chain Tracer

Follow a URL's full redirect chain server-side and see every hop, status code, and the final destination.

Hostname to Punycode Converter

Convert an internationalized domain name (IDN) with non-ASCII characters to its ASCII Punycode (xn--) form.

See also

  • Guide How URLs and Query Strings Work
    The seven parts of a URL, which characters need percent-encoding and why, how query strings carry repeated keys.
  • Glossary Phishing
    Phishing is a scam in which attackers pose as a trusted organisation or person, usually by email or text.
  • Glossary Punycode
    Punycode is the encoding that lets domain names with non-ASCII characters be stored in the ASCII-only DNS, marked by the prefix xn--.
  • Glossary Short URL
    A short URL is a compact link that redirects to a longer address, made by a link-shortening service.
  • Glossary Redirect
    A redirect is a server response that sends the browser to a different URL, using a 3xx status code and a Location header.

Frequently Asked Questions

The URL Defanger, URL Parser, URL Decoder and Hostname to Punycode Converter run in your browser and never visit the link. The Short URL Expander and the HTTP Redirect Chain Tracer do contact the link, but from this site's server, so the destination sees our server rather than your device. Still, treat the result as untrusted text.

Private browsing hides history, not your IP address or your device from the destination, and a malicious page can still try to exploit the browser or collect credentials you type. Analyse first, visit only if you must, and then from a disposable environment.

No. A clean-looking link can redirect through several hosts, and an attacker can register a convincing domain. Check the real host and the redirect chain rather than the visible text.

Back to the how-to guides
AdSense Placeholder
Slot: footer_leaderboard