Read a link before you tap it
A fake website can copy every logo, colour and word of the real one. The one thing it can’t copy is the real site’s address. Every web address contains a single part that says whose site it is, and once you know where to look, it takes about two seconds to find. In this lesson you’ll learn to find it in any link, see the address hiding behind any text, and catch letters borrowed from other alphabets.
In this lesson
- Find the part of a web address that tells you whose site it is
- See the real address behind a link without opening it
- Catch the tricks scammers use to make a fake address look right
You’ll need: a phone or computer, and an email or text message that contains a link (any newsletter will do).
The one part that matters
Take this address, the kind that turns up in a fake “your account is locked” message:
https://www.amazon.co.uk.order-help.top/refund?id=48213It mentions Amazon twice, but it isn’t Amazon’s. Here’s how to read any address:
- Skip the
https://at the start. - Find the first single slash after it (here, the one before
refund). If there’s no slash, use the end of the name. Everything after that slash is just which page on the site you’re going to. - Look at the name just before that slash, and read it from the right. The last two parts, here
order-help.top, are the domain: the name someone registered. That’s whose site it is. - Everything to the left of the domain, here
www.amazon.co.uk., was added by whoever owns the domain. They can put any words they like there.
.co.uk, .com.au or .co.nz. With those, take three parts instead of two: in www.bbc.co.uk/news the domain is bbc.co.uk.The tricks that make a fake address look right
| Trick | Example | Whose site it really is |
|---|---|---|
| The real name added on the left | paypal.com.account-check.top | account-check.top |
| Extra words around the brand | secure-amazon-account-help.com | Not Amazon’s. Hyphens make it a different name. |
| Letters that look alike | rn in place of m, or l in place of I | A different name that’s easy to misread |
| Letters from another alphabet | a Cyrillic Π° in “pΠ°ypal.com” | A different domain that looks identical on screen |
| Everything before an @ | https://paypal.com@198.51.100.23/ | The address after the @. Browsers ignore what comes before it. |
| A link shortener | bit.ly/3xYz | You can’t tell until it’s opened, so treat it with care |
The padlock in the address bar doesn’t help here. It means the connection is encrypted, not that the site is honest: fake sites get padlocks too, free, in minutes. What Is SSL/TLS? explains what the padlock does prove.
Try it yourself Β· part 1
See the real address behind a link
The words you click on and the address they go to are two separate things. A button that says “amazon.co.uk” can lead anywhere. Open an email or text with a link in it, then:
- On a computer: move the mouse over the link without clicking. The real address appears in the bottom corner of the browser window.
- On a phone: press and hold the link. A preview opens with the address shown at the top. Read it, then close the preview; don’t tap Open.
Find the domain in that address using the steps above. Does it match the company the message claims to be from?
Try it yourself Β· part 2
Whose site is it?
For each address, find the domain and decide whose site it is. Then open the answer to check. These are examples: don’t type them into a browser.
1. https://www.amazon.co.uk/your-orders
amazon.co.uk, Amazon’s real UK site. The slash comes straight after the name, and .co.uk is a two-part country ending, so the domain is the last three parts.
2. https://amazon.co.uk.order-help.top/refund
order-help.top. Not Amazon. Everything before it is decoration added by whoever registered order-help.top.
3. https://secure-amazon-account-help.com/login
secure-amazon-account-help.com, which is not Amazon’s. It’s one long name that anyone could have registered; the word “amazon” inside it proves nothing.
4. https://login.microsoftonline.com/
microsoftonline.com, which really is Microsoft’s: it’s where many Microsoft work and school accounts sign in. A strange-looking name can be genuine, which is why the safest habit is to sign in from a site or app you already use, rather than from a link.
5. https://bit.ly/3xYz9q
bit.ly, a link shortener. It forwards you somewhere else, and the address doesn’t tell you where. In a message from someone you don’t know, that alone is a reason not to tap.
Try it yourself Β· part 3
Catch letters from another alphabet
- Open the Lookalike Domain Checker. It reads the characters you give it in your browser and doesn’t visit the site.
- Click the sample marked paypal.com (mixed). It looks exactly like paypal.com, but the result says MIXED SCRIPTS: one of the letters is Cyrillic.
- Look at ACTUALLY RESOLVES. That’s the coded form, starting
xn--, that the name is really stored as. Two names that look the same on screen always have different codes. - Now type the domain from the link you checked in part 1. An ordinary name comes back as PLAIN ASCII. As the tool says, that means no letters are disguised; it doesn’t mean the site is safe. Whose domain it is still matters most.
Key takeaways
- Whose site it is depends only on the domain: the name just before the first single slash, read from the right.
- Brand names on the left of the domain, or inside a longer name, prove nothing.
- Hover over a link on a computer, or press and hold on a phone, to see where it really goes.
- The padlock means encrypted, not honest.
- When in doubt, don’t use the link: go to the site or app you already know.
Check yourself
Three questions. Pick one answer each and you’ll see why.
1. What is the domain in https://login.yourbank.com.secure-verify.top/account?
2. A site shows a padlock in the address bar. What does that tell you?
3. Two addresses look identical, but the Lookalike Domain Checker says one has MIXED SCRIPTS. What does that mean?
Next, the link you can’t see at all: a QR code.
This lesson is part of the free course Scams and Staying Safe, licensed under CC BY-NC-SA 4.0: you may share and adapt it for non-commercial use, with credit to ExamineIP and a link to the original.