Phishing links are built to survive a quick glance. The brand name is there, the padlock is there, and the page looks right. Learning to read a URL the way a browser reads it takes a few minutes, and it catches most of the tricks below.
The examples in this post use our own domain, angelforce.eu, and reserved example domains. Do not visit lookalike domains to test them.
Find the part that matters - the registrable domain
A web address has several parts. Only one of them tells you who controls the site.
https://login.angelforce.eu.account-check.example/session/verify?ref=angelforce.eu| Part | Value | Who controls it |
|---|---|---|
| Scheme | https | Says nothing about who owns the site |
| Subdomains | login.angelforce.eu | Whoever owns the registrable domain |
| Registrable domain | account-check.example | The domain owner - this is the site |
| Path and query | /session/verify?ref=angelforce.eu | The domain owner, and they can write anything here |
Read the host name from right to left. Start at the end, .example, and take one more label to the left. That pair is the registrable domain, and whoever registered it controls everything to its left. Our name appears twice in the link above, and neither appearance means anything.
Some endings need two or more labels. co.uk is a public suffix, so in shop.example.co.uk the registrable domain is example.co.uk. Browsers rely on the community-maintained Public Suffix List for this, for example to highlight the most important part of a domain in the address bar.
The padlock and https only mean the connection is encrypted. Anyone can get a certificate for a domain they control, including an attacker.
Lookalike domains
The simplest trick is a domain that reads like yours at a glance:
- a swapped letter:
angeIforce.eu, with a capital I instead of a lower-case l, which look alike in many fonts - an extra word:
angelforce-security.euorangelforce-eu.com - a different ending:
angelforce.coinstead ofangelforce.eu
None of these belongs to us. Any of them could be registered by anyone.
Homographs and punycode
Domain names can contain letters from other alphabets. In DNS they are stored in an ASCII form that starts with xn--, produced by an algorithm called Punycode. The Cyrillic letter "а" looks the same as the Latin "a" in most fonts, so:
аngelforce.eu (first letter is Cyrillic)
xn--ngelforce-zyh.eu (what DNS actually sees)Chrome shows a label in its xn-- form when it mixes scripts in risky ways, for example Latin with Cyrillic. It also catches names written entirely in lookalike letters, such as аррӏе.com, which it shows as xn--80ak6aa92e.com, and lookalikes of popular domains.
Do not rely on this alone. These checks protect well-known domains best, and they do not apply to the text of a link in an email, which can say anything. If you ever see xn-- in a link you were not expecting, treat it as suspicious.
The @ trick
If an @ sign appears before the first / after https://, everything in front of it is "user information", not the host. RFC 3986 warns that this part can be crafted to look like a trusted domain name.
https://www.angelforce.eu@203.0.113.50/loginThis link goes to the server at 203.0.113.50. The www.angelforce.eu part is treated as a user name, not as the destination. A legitimate service has almost no reason to send you a link containing @ before the host.
Shorteners and QR codes
Short links and QR codes hide the destination until after you click or scan. That is their purpose, and it is also why attackers use them. The NCSC advises being wary of scanning QR codes in emails. Expand a short link with a link checker before opening it, or go to the service directly instead.
Open redirects
Some legitimate sites have a redirect feature that sends visitors to any address given in a parameter. The OWASP cheat sheet on unvalidated redirects shows a pattern like this:
https://example.com/example.php?url=https://malicious.example.comThe link starts with a real, trusted domain, which is the point. Look for parameters such as url=, next=, redirect= or return= that contain a second full address. The second address is probably where you will end up.
Misleading paths and subdomains
Brand names in the path or in subdomains cost an attacker nothing:
https://secure-login.example/angelforce.eu/microsoft365/signin
https://angelforce.eu.secure-login.example/Both links belong to secure-login.example. Long paths with brand names, words like "secure", "verify" or "account", and lots of random characters are not proof of phishing, but they are a reason to look closer.
Unfamiliar top-level domains
Some top-level domains look like something else. .zip has been a delegated top-level domain since 2014, so invoice.zip can be a website rather than a file. A link ending in a file name may not be a file at all.
Practical habits
- Hover or long-press before you click, and read the real destination, not the link text.
- Go to important sites yourself. Use bookmarks or type the address for your bank, payroll and Microsoft 365 or Google login.
- Check with the sender through a known channel. The NCSC advises contacting the organisation directly using details from its official website, not those in the message.
- Use a password manager. It fills passwords only on the site where you saved them, so it will not offer your password on a lookalike domain. Passkeys go further, because each one is bound to the real site.
- Watch for pressure. The NCSC lists authority, urgency, emotion, scarcity and current events as common hooks in scam messages.
- Report it. A suspicious message that you report helps protect your colleagues, even if you did not click.
Where to start
Paste a suspicious link into our link checker to see where it really goes without opening it. If the email itself looks wrong, our email header analyser shows which servers handled it and whether SPF, DKIM and DMARC passed.
If you would like your team trained to read links this way, our consulting and training service can help.
