How to Identify Fake URLs and Phishing Links

A login page can look exactly like the real thing while its address leads somewhere else. Phishing links use lookalike domains, confusing subdomains, Unicode characters, and short links to make a fake destination seem trustworthy. If you enter a password or one-time code on the wrong site, an attacker may be able to use it.

This guide explains how to identify fake URLs, check where a link really leads, and respond safely if something seems suspicious. The examples use fictional .test domains rather than live malicious links.

Key takeaways

Read the hostname from right to left and identify the actual registered domain, not just a familiar word in the address.
A padlock and https:// indicate an encrypted connection; they do not prove a site is legitimate.
Unicode characters can resemble Latin letters. Punycode is one way internationalized domain names are represented in DNS.
Treat unexpected shortened links and login requests with caution. When in doubt, open the service through its official app or a saved bookmark.
Never share a password, payment PIN, or one-time password (OTP) in response to an unexpected message or call.

How fake login URLs create trust

Phishing messages often pair a believable story with a link: an account needs verification, a parcel is delayed, or a payment requires attention. The urgency is intended to make people click before checking the destination. The page may copy familiar logos and design, but the address bar is a separate clue that should be checked carefully.

A URL has several parts. In https://account.example.test/sign-in, the scheme is https, the hostname is account.example.test, and the path is /sign-in. The hostname is the key part to inspect when deciding which site you are visiting. You can inspect URL components to make those parts easier to distinguish, but a parser cannot determine by itself whether a site is trustworthy.

Check the hostname, not the familiar words

A common trick is to put a real company name somewhere in a longer hostname. For example:

https://bank.example.test.attacker.test/ has the hostname bank.example.test.attacker.test. Its ending domain is attacker.test, not example.test.
https://example.test.attacker.test/ also belongs under attacker.test.
https://example.test@attacker.test/ uses example.test as user information before the @. The hostname is attacker.test.

These are fictional examples. The important habit is to find the hostname boundaries and determine which domain controls the site. Do not assume that a familiar brand name at the start of a URL makes the destination official.

For a domain such as login.shop.example.test, the subdomains are login.shop, while the final registered domain is generally example.test. Domain registration rules can be more complex than simply taking the last two labels, so when the right-hand part is unfamiliar, verify the official domain through a trusted source rather than guessing.

Watch for lookalike characters and punycode

Some characters from different writing systems look similar to Latin letters. A fake domain might substitute a visually similar character, making a quick glance unreliable. The exact appearance depends on the font, browser, and text context.

Internationalized domain names allow domain labels containing non-ASCII characters. DNS-compatible forms can represent these labels using punycode, which commonly begins with xn--. Seeing xn-- is not proof of fraud: legitimate internationalized domains can use it too. Conversely, a displayed Unicode form may be difficult to distinguish from a familiar spelling.

If a domain looks unusual, do not rely on visual comparison alone. Navigate using the service's official app, a bookmark you created earlier, or an address you independently obtained from trusted documentation. Avoid copying a suspicious address into a browser just to investigate it.

Shortened links hide the destination

A link shortener replaces a longer URL with a compact redirecting URL. That can be useful in legitimate messages, but it also means the visible text may not reveal the final destination. Link previews or expansion services can sometimes show where a short link leads, but results may be incomplete, and following a redirect can change what you see.

For an unexpected shortened link that asks you to sign in or provide payment details, the safest approach is usually not to use it. Open the service through its official app or enter a known address yourself. Do not treat a preview as a security guarantee.

HTTPS is not proof that a site is genuine

https:// means the browser is using an encrypted connection to the named site, subject to the browser's certificate checks. It helps protect data in transit, but it does not establish that the site belongs to the company you intended to visit. A phishing site can also use HTTPS.

Check the hostname even when the browser shows a padlock or other secure-connection indicator. If the browser displays a certificate or connection warning, do not bypass it to reach a login page.

A practical link-checking workflow

Before signing in from a message, use this sequence:

Pause. Be especially cautious if the message creates urgency, threatens account closure, or offers an unexpected reward.
Check how you received the link. An unexpected message from a familiar-looking sender is not proof that the sender or link is genuine.
Inspect the full hostname. On a computer, hover over the link to view its destination without opening it. On a phone, press and hold only if your device shows a link preview without navigating; interface behavior varies. Never rely on the message's displayed link text alone.
Look for domain tricks. Check for extra words after a brand name, an unfamiliar ending, misspellings, @ signs, or characters that appear unusually similar.
Avoid entering credentials from the message. Open the official app or use a bookmark or address you already trust, then check for the requested account notice there.
Stop if anything remains unclear. Contact the organization using contact details from its official app, card, or independently located website—not the message itself.

Common mistakes to avoid

Trusting a logo or page design: These are easy to copy and do not verify the site's identity.
Checking only the beginning of the URL: The actual destination is determined by the hostname structure, not by the first familiar word.
Assuming HTTPS means safe: Encryption and legitimacy are different questions.
Treating every unfamiliar character as malicious—or harmless: Unicode domains can be legitimate, but visual similarity makes careful verification important.
Opening a short link to see what happens: A redirect may take you to a different destination than expected.
Sharing an OTP to prove your identity: Do not disclose OTPs, passwords, or payment PINs to someone who contacted you unexpectedly. A legitimate-looking page or caller is not enough reason to share them.

If you already opened a suspicious page

If you only opened the page and did not enter information, close it and do not download files or approve prompts. If you entered a password, go directly to the legitimate service using its official app or a trusted address and change that password. If you reused it elsewhere, change it on those accounts too. Enable multifactor authentication where available, review recent account activity, and sign out other sessions if the service provides that option.

If you shared payment details, an OTP, or sensitive personal information, contact your bank or the affected organization promptly using a verified contact channel. Follow its advice about securing the account and reporting the incident. Do not continue communicating through the suspicious link or message.

Conclusion

To identify fake URLs, focus on the actual hostname, be alert to lookalike characters and redirects, and remember that HTTPS does not certify a site as genuine. When a login link is unexpected or unclear, skip it and reach the service through a route you already trust. A few seconds of checking can help prevent a convincing page from capturing your credentials.