Is this link safe? How to tell before you click

Short answer: A link is safe if it comes from a trusted sender, points to the domain you expect, uses HTTPS, and shows no signs of urgency or deception. When you are not sure, do not click. Instead, inspect the URL manually or open it in an isolated environment where nothing can reach your device.

This guide walks you through how to read a URL and recognise danger signals — before your cursor gets anywhere near it.

Why links are the most common attack vector

Every phishing campaign, malware drop, and credential-theft attempt starts the same way: someone clicks a link. The link is the delivery mechanism. The attacker's job is to make it look ordinary enough that you do not think twice.

Your job is to slow down for two seconds and read what is actually there.

Red flags in the URL itself

You do not need specialist tools to spot a suspicious link. Most danger signals are visible if you know what to look for.

Lookalike and typosquatted domains

Attackers register domains that look like trusted brands at a glance. Common patterns:

Character substitution: paypa1.com (the letter l replaced with the number 1), arnazon.com
Extra words: amazon-secure-login.com, apple-id-verify.net
Wrong TLD: netflix.com.co, google.com.ph when you live somewhere else and were not expecting a regional redirect

Read the domain carefully, left to right. The part immediately before the first single slash is the real host.

Misleading subdomains

This is one of the most effective tricks and one of the most overlooked. Consider:

paypal.com.login-verify.net

The real domain here is login-verify.net. The paypal.com part is just a subdomain. It sounds authoritative. It is not. Browsers show the full URL — your eye tends to stop at the familiar brand name and skip the rest.

Rule: read from the right side of the domain backward to the first dot that matters.

URL shorteners hiding destinations

bit.ly/x7Kq2, t.co/abc123, tinyurl.com/something — all perfectly normal in social media contexts, all completely opaque about where they go. A shortener link in an unexpected email or message is a red flag worth taking seriously.

You can expand most shorteners without clicking: paste the short URL into a service like CheckShortURL or add a + to the end of a Bit.ly link (bit.ly/x7Kq2+) to see the preview page. More on that in the next section.

Punycode and homograph characters

Unicode allows characters from non-Latin scripts that look identical to Latin letters. аmazon.com and amazon.com can look the same in a message body — one uses a Cyrillic "а". Browsers often display these as punycode (xn--mazon-3ve.com), but messaging apps and email clients may render the visual lookalike.

If a link looks right but feels off, copy the domain into your browser's address bar and read what it resolves to.

HTTP versus HTTPS — and why the padlock is not enough

HTTPS means the connection is encrypted. It does not mean the site on the other end is trustworthy. Phishing sites routinely use HTTPS and display a padlock. Getting a TLS certificate costs nothing and takes minutes.

What HTTPS does tell you: the data you send travels encrypted. What it does not tell you: who owns the server receiving it.

An HTTP link (no padlock) is an additional red flag, especially for anything asking you to log in or enter payment details. But a padlock alone is not a green light.

Excessive redirects and tracking parameters

Long URLs stuffed with redirect=, url=, or r= parameters may chain through multiple destinations before landing somewhere. Each hop is a chance to obscure the final destination. A URL that reads like a tracking chain — especially one ending in a domain you do not recognise — deserves scrutiny.

Urgency bait in the surrounding message

The URL is only part of the picture. The message carrying it matters too. Classic signals:

"Your account will be suspended in 24 hours"
"You have a pending delivery — confirm now"
"Unusual sign-in detected — verify immediately"

Urgency short-circuits careful thinking. That is the point. When the message pressure-tests your caution, slow down.

How to inspect a link without clicking it

Hover to preview

On desktop, hover your mouse over a hyperlink without clicking. The actual destination URL appears in the status bar at the bottom of your browser or email client. Compare it to what the anchor text says. If the visible text says "Click here to log in to your bank" but the URL points somewhere unrelated, that is a clear mismatch.

Expand shortened URLs

Before clicking any short link:

Use a shortener expander tool to reveal the full destination.
Read the expanded URL the same way you would any other — look at the real domain, check for the patterns above.
If the expanded destination still looks unfamiliar, treat it as suspicious.

Check where the link came from

Context is evidence. Ask:

Did you expect this message from this person?
Did you initiate any action that would generate this link (a password reset, a delivery, a receipt)?
Is the sender's email address or phone number the one you have on file?

An unexpected link from a known contact is still worth scrutinising — accounts get compromised, and attackers spoof sender addresses.

The limits of static URL scanners

URL scanners like VirusTotal or Google Safe Browsing check a link against databases of known malicious sites. They are useful and worth using. They also have a structural weakness: they rely on reputation data that lags behind real threats.

A phishing domain registered this morning has no reputation yet. It will not appear on any blocklist. A scanner checking it right now will return clean — not because it is safe, but because it is new.

For a deeper look at why static scanners fall short and what to do instead, read the safe link checker guide on Tempbrowser. It covers the full picture of how phishing evades reputation-based detection and what a dynamic check actually shows you.

The zero-risk option: open it in a disposable cloud browser

When you have done the manual checks and still are not sure — or when the link came from somewhere that makes you genuinely uneasy — the safest move is to open it in an environment that is not your device.

Tempbrowser is a throwaway browser in the cloud. You paste the URL. It opens inside a temporary virtual computer, streamed to your screen. The page runs there, not here. No code ever touches your computer.

The Tempbrowser analyzer adds a layer on top: it captures screenshots as the page loads, so you can see what it actually does — what it renders, whether it immediately redirects, whether it shows a login form pretending to be something else — without any of that activity happening on your machine.

When the session ends, the entire environment is wiped. No history. No cookies. No trace.

The free plan requires no signup and no credit card. You get three launches per 24 hours with sessions that last a few minutes — more than enough to see what a suspicious link actually does. If you need longer sessions or unlimited launches, Pro is $4.99 per month billed yearly with 60-minute sessions.

It pairs well with understanding what disposable browsers actually are — if that concept is new to you, that post explains the mechanics.

FAQ

What happens if I click a phishing link?

It depends on what the page does. Some phishing pages are purely credential-harvesting forms — they only cause damage if you enter your username and password. Others attempt to exploit browser vulnerabilities to install malware automatically (called drive-by downloads). The risk varies, but the safest assumption is that clicking an unknown link on your real device carries real risk.

Can a link infect my phone just by opening it?

Yes, it is possible. Mobile browsers are not immune to exploit-based attacks. In practice, most phone-targeted phishing aims at credential theft via fake login pages rather than malware installation — but zero-click and drive-by exploits for mobile browsers do exist, particularly against unpatched devices. Keeping your OS and browser updated is the baseline defence.

Are link checkers accurate?

Reputation-based link checkers are accurate for known threats and useless for new ones. A domain registered hours ago will pass every scanner cleanly. That does not make it safe. Use scanners as one signal among several, not as a final verdict.

How do I check a link on mobile?

Mobile makes this harder. There is no hover preview, and long-pressing to copy a link takes a moment. Steps that help:

Long-press the link and choose "Copy link" rather than tapping it.
Paste into a notes app and read the full URL carefully.
Run it through a shortener expander if it is a short link.
If still unsure, open tempbrowser.app/en/analyzer on your phone's browser, paste the URL there, and let the sandbox load it instead of your device.

What if the link looks fine but the email still feels wrong?

Trust the feeling. URL hygiene is one signal; context is another. If the message arrived unexpectedly, uses unusual language, or asks you to do something out of the ordinary, verify through a separate channel — call the sender, log in to the service directly by typing the URL yourself, or contact support. Do not use any contact information provided in the suspicious message itself.

The bottom line

Reading a URL takes two seconds. Recovering from a compromised account or an infected device does not. Slow down, check the domain, check the context, and when the signal is ambiguous — open it somewhere that is not your computer.

One click. Disposable. Try the Tempbrowser analyzer — no signup required.