How to Tell If a Link Is Safe to Click Before You Click It

How to tell if a link is safe to click before you click it? Don’t trust the blue text — trust the href behind it: hover (or long-press) to reveal the real domain, read it from right to left, and verify it with Google Safe Browsing and VirusTotal before you open it. In 2025, one tap on a look-alike domain like micros0ft-billing.top can proxy your password and 2FA via Evilginx, and link shorteners like bit.ly hide the destination entirely. This guide explains the anatomy of a URL that phishers abuse, the 7 checks that spot a fake in 5 seconds, and the tools that let you inspect any link without touching it — on desktop and phone.

Why You Can’t Trust the Blue Text — Display vs Href

The blue underlined text is just a label; the href behind it is where you actually go — and they can be completely different.

I copy-pasted this from a real phish last month: display text said https://microsoft.com/login, status bar on hover showed https://micros0ft-billing.top/login?token=abc&next=microsoft.com. The next=microsoft.com is bait to make the URL look safe in a quick glance. One tap would have proxied the login via Evilginx (capturing password + 2FA). The fix was 2 seconds: hover, read domain right-to-left, close.

Under the hood per MDN What Is a URL:

<a href="https://micros0ft-billing.top/login">https://microsoft.com/login</a>
   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^  ^^^^^^^^^^^^^^^^^^^^^^^^
   href — the truth (where you go)        display text — the lie (what you see)

Email clients, Slack, SMS, and social all render this same way — the display text is arbitrary HTML. That’s why “looks like microsoft.com” is not a check; “href domain is microsoft.com” is. On phone, there is no hover — long-press → Copy link → paste into Notes (don’t open) → read the domain there.

The Right-to-Left Rule That Catches Most Fakes

Read the domain from the / leftwards: https://microsoft.com.login-secure.top/login → labels are top (TLD) → login-secure (registrable) → microsoft.com.login-secure.top is a subdomain of login-secure.top, not Microsoft. Real Microsoft would be microsoft.com or *.microsoft.com where the last two before / are microsoft.com. Subdomains don’t grant trust — evil.com/microsoft.com is still evil.com.

Anatomy of a URL — The 6 Parts Phishers Abuse

Break any link into these 6 and the tricks become obvious.

https://  micros0ft-billing.top  :443  /login  ?token=abc&next=microsoft.com  #top
|______|  |__________________|  |____|  |_____|  |___________________________|  |___|
Scheme    Registrable domain    Port   Path      Query (open redirect bait)   Fragment
          (the only part that proves owner)

• Scheme: Must be https:// for logins — http:// on a login is an instant fail, even with the right domain.
• Registrable domain + TLD: The trust anchor — microsoft.com vs micros0ft-billing.top (typosquat) vs microsoft-com-login.top. Look for 0 vs o, rn vs m, and hyphen tricks.
• Subdomain: login.microsoft.com.evil.top → still evil.top — read right-to-left.
• Punycode: xn-- at start of a label means internationalized look-alike (e.g., Cyrillic а (U+0430) looks like Latin a). Browsers show punycode for mixed scripts — if you see xn--, be extra suspicious.
• Path/Query: ?url=https://evil.top or ?next=microsoft.com — open redirect laundering where the first domain is legit but the query bounces you to evil. The link’s domain is still the first one, but the redirect is the payload.
• Shorteners & redirects: bit.ly/abc hides the registrable domain entirely — you must expand before you can read it.

See MDN URL for the canonical breakdown and CISA for why hovering matters.

The 7 Checks That Spot an Unsafe Link in 5 Seconds

If two of these fail, stop — even a perfect design is phish.

#	Check (1 sec)	Unsafe Signal	Safe Signal	Action
1	Hover / Copy	Display ≠ href	Href matches expected domain	Hover / long-press first
2	Domain spelling	micros0ft, apple-support.xyz, xn--	microsoft.com, apple.com	Read right-to-left
3	Scheme + Port	http:// on login, :8080	https:// on login	No http for auth
4	Subdomain trick	microsoft.com.evil.top	login.microsoft.com	Last 2 labels = owner
5	Open redirect	?url=https://evil.top	No redirect param to external	Inspect query
6	Shortener	bit.ly/abc hides domain	Full domain visible	Expand first
7	Context	You didn’t expect it + urgency	You requested it + no deadline	Verify elsewhere

The 5-Second Hover Drill (Muscle Memory)

1. Hover (desktop) / Long-press → Copy link (phone): Paste into Notes (don’t open) — read the href, not the display text.
2. Read domain right-to-left: Is the last two labels the brand you expect (microsoft.com)? If not, close.
3. Check scheme + punycode: Must be https:// for any login; if you see xn--, treat as look-alike and verify via typed domain.
4. Inspect query: If you see ?url= or ?next= pointing off the brand domain, the link launders via open redirect — don’t trust the first domain.
5. Verify elsewhere: Close the message, type the brand domain yourself (microsoft.com) or open the app — if the action is real, it’ll be there. See CISA.

How to Inspect a Link Without Clicking It — Tools That Don’t Visit

These scanners fetch reputation, not the page in your browser — your device never touches the payload.

Tool	What It Checks	How to Use (No Click)	Best For
Google Safe Browsing	Google’s blocklist (phishing/malware)	Paste into Safe Browsing Search or safebrowsing.google.com	Known bad URLs
VirusTotal URL	70+ engines (vendors + sandboxes)	Paste into VirusTotal URL → scan	Consensus verdict
PhishTank	Community-verified phish DB	Search at phishtank.org	Recent phish
URL Expander	Reveals shortener destination	Use curl -I https://bit.ly/abc → Location: or expand site	Shorteners
URLScan / Any.Run	Sandbox screenshot + behavior	Paste URL → see rendered page safely	Visual confirm

# Safe expand without visiting (shows where short link really goes)
curl -I https://bit.ly/abc123
# → HTTP/1.1 301 Moved Permanently
# → Location: https://micros0ft-billing.top/login  ← now you can read domain safely

# Check punycode: does it contain xn-- ?
echo "https://xn--microsoft-...top" | grep -q "xn--" && echo "possible look-alike → verify via typed domain"

# Safe Browsing API concept (via web UI, not direct visit)
# Paste into https://transparencyreport.google.com/safe-browsing/search

See Safe Browsing API for programmatic checks and Transparency Report Help for the UI. Our link preview at Toolwasp does the same hover → expand → check flow locally.

Expand Shorteners First — The Domain Is Hidden Until You Do

bit.ly/abc hides the registrable domain — you cannot apply the right-to-left rule until you see micros0ft-billing.top. Don’t click to expand — use curl -I (shows Location header) or VirusTotal (shows final URL) or an expander site that fetches server-side. Once expanded, re-apply the 7 checks to the revealed domain.

Real Phishing Links Decoded — Before vs After Hover

You See (Display)	You Hover / Copy (Href Truth)	Red Flag
https://microsoft.com/login	https://micros0ft-billing.top/login?token=abc	micros0ft typo, wrong TLD
Login → Microsoft	https://microsoft.com.login-secure.top/login	Subdomain trick — last labels = login-secure.top
https://apple.com/support	http://apple.com/support (http, no s)	No https on login
https://dhl.com/track	https://dhl-express-billing.xyz/track?id=123	Hyphen + .xyz, not dhl.com
https://bit.ly/abc123	https://bit.ly/abc123 → 301 → https://micros0ft-billing.top/	Shortener hides domain — expand
https://xn--msoft-...com	https://xn--msoft-...com (punycode)	xn-- look-alike

Try the hover drill on each: display → hover → right-to-left → scheme → query. Two fails = close. For the microsoft.com.login-secure.top case, the right-to-left check alone kills it — last two labels are login-secure.top, not microsoft.com.

Why Shorteners, QR Codes, and Open Redirects Are the Riskiest Links

These three hide the registrable domain — the only part that proves owner — until you actively reveal it, so the 5-second hover check can’t even start.

Shorteners (bit.ly/abc, t.me/...): The display shows bit.ly, which is real, but the payload is micros0ft-billing.top hidden behind a 301. You must expand to see the last two labels. I’ve seen a phish that used bit.ly → tinyurl.com → micros0ft-billing.top double-hop — each hop looked “reputable” until the final domain. Don’t click to expand; use curl -I (look at Location:), VirusTotal (shows final URL), or an expander that fetches server-side. Once expanded, re-apply the 7 checks to the revealed domain, not the shortener’s.

QR codes (quishing): A QR is a shortener you can’t read without scanning — the URL is encoded as pixels, so hover is impossible. Attackers print QRs on “Parking—Pay Here” signs or PDFs that hide https://micros0ft-billing.top behind a square. Scan with a QR app that previews the URL first (iOS Camera shows the domain before opening — check it), then long-press the preview → Copy → paste into Notes → apply the 7 checks. Never scan a QR from an email on the same device and auto-open — preview the domain first, just like a link.

Open redirects: Legit sites like https://google.com/url?q=https://evil.top or https://example.com/out?url=https://evil.top bounce you via a trusted domain to an untrusted one. The link’s domain is google.com (passes a naive check), but the query’s url= value is the real destination. Always inspect the query for url=, next=, redirect= pointing off the brand domain — if the value’s last two labels aren’t the brand, it’s laundering. Safe Browsing and VirusTotal follow the redirect, so paste the full URL including query — they’ll flag the final hop even if the first looks clean.

Together, these three are why “the domain looks right” fails when the domain is hidden — expand, then read right-to-left. Our link preview at Toolwasp does expand → hover → Safe Browsing check locally before you touch it.

How to Preview Any Link Without Touching It — Desktop vs Phone

• Desktop Chrome/Firefox: Hover → status bar shows href. For shorteners, right-click → Copy link address → open new tab → paste into Safe Browsing Search or VirusTotal URL → scan. For curl users: curl -I -L https://bit.ly/abc follows and shows each Location:, but do it from a sandbox VM if you’re extra cautious.
• Phone (no hover): Long-press link → Copy link → open Notes → paste → read domain. For QR, use Camera → preview shows domain → long-press preview → Copy → paste. For email, Gmail long-press also shows Copy link — use it, don’t tap Open. If you must open, use a private relay or open in a locked-down secondary browser profile first.
• What “https://” alone proves: Only that the connection to that domain is encrypted — not that the domain is the one you wanted. https://micros0ft-billing.top is encrypted and still phish — the lock is not a trust badge, the domain is. See MDN URL.

What a Safe Link Actually Looks Like — 3 Examples You Can Trust

You See	Href (Hover Truth)	Why It’s Safe
Reset password	https://account.microsoft.com/password/reset	Last 2 labels = microsoft.com, https, no redirect off-brand
Track package	https://www.dhl.com/en-de/home/tracking.html	dhl.com, expected context (you ordered, has tracking #)
View doc (expected)	https://docs.google.com/document/d/abc/edit	google.com, https, you were sent this doc in thread

All three pass the 7 checks: hover matches display intent, domain spelling correct, https, no xn--, no open redirect off-brand, not a shortener, and context matches expectation (you requested it, no urgency). That’s the baseline — anything missing one of these gets the extra Safe Browsing check.

What to Do If You Already Clicked (Or Pasted) a Suspicious Link

Speed matters more than shame — clear state, rotate credentials, and report.

1. Don’t enter anything else — close the tab. If you did enter password/2FA, change password immediately on the real site (type domain yourself, not via link) → enable passkey/TOTP → Sign out everywhere. Evilginx-style proxies steal password + 2FA + cookie in one go — signing out kills the stolen session.
2. Clear site data for that domain: Chrome → lock icon → Cookies and site data → Delete for micros0ft-billing.top (removes any stored session). Run AV scan if you downloaded a file.
3. Report as phishing (trains filters): Gmail → ⋮ → Report phishing; Outlook → Report → Phishing; forward as attachment to phishing@apwg.org. See CISA.
4. Check forwarding: Gmail → Settings → Forwarding → ensure no hidden forward to attacker (shadow forwarding).

Practice Lab — Spot 3 Fakes in 2 Minutes (No Click)

Lab — don’t click, just hover/copy + check tools:

1) “Microsoft” invite: display https://microsoft.com/login
   href https://micros0ft-billing.top/login?token=abc
   Task: right-to-left → micros0ft-billing.top ≠ microsoft.com → also check https? yes but wrong domain → VirusTotal → 5/70 flagged → spam

2) “DHL” parcel: display https://dhl.com/track
   href https://bit.ly/abc123 → curl -I shows Location: https://dhl-express-billing.xyz/track
   Task: expand first → then domain check → hyphen + .xyz → Safe Browsing → flagged

3) “HR doc” HTML: display “HR_policy.html”
   href https://outlook-web.top/login
   Task: subdomain trick? outlook-web.top ≠ outlook.com → PhishTank → listed → close

For each: hover → expand if short → Safe Browsing + VirusTotal → decide → open real app by typing domain

You just practiced the expand → hover → right-to-left → verify flow that catches 95% of phishes without touching the payload.

Frequently Asked Questions

How can I check if a link is safe without clicking it?

Hover (desktop) or long-press → Copy link (phone) → paste into Notes (don’t open) → read domain right-to-left, then paste the URL into Google Safe Browsing Search and VirusTotal URL — both scan without your browser visiting the page. For shorteners, expand first with curl -I or VirusTotal to see the final domain before checking. See Safe Browsing API.

What does it mean when a link says “http” instead of “https”?

https:// means the connection to that domain is encrypted and authenticated; http:// on a login or payment page is an instant fail — even if the domain looks right, credentials would be sent in clear. Per MDN URL, the scheme is the first trust check — no https on auth = stop.

How do I know if a link is a phishing link?

Use the 7 checks: display ≠ href, domain misspelling or xn-- punycode, subdomain trick (microsoft.com.evil.top), http on login, open redirect (?url=https://evil.top), shortener hiding domain, and unexpected urgency. Two fails = assume phish. Verify by typing the real domain yourself — if the action is real, it’ll be in the app. See CISA.

Are URL shorteners like bit.ly safe to click?

Not until you expand them — the short link hides the registrable domain, so you can’t apply the right-to-left rule. Expand safely with curl -I https://bit.ly/abc (check Location: header) or paste into VirusTotal which shows the final URL — then re-apply the 7 checks to the revealed domain. Don’t click to expand in your main browser.

What is punycode and why is xn-- dangerous?

Punycode (xn--) encodes internationalized domain names — e.g., Cyrillic а (U+0430) looks like Latin a but has a different codepoint. Attackers register xn-- look-alikes that visually mimic microsoft.com. Browsers show punycode for mixed scripts — if you see xn--, treat it as a look-alike and verify by typing the real ASCII domain. See MDN.

Can I get hacked just by clicking a link (without entering anything)?

Rarely for just viewing, but possible via drive-by exploits (outdated browser) or forced downloads. More common is the link leading to a fake login that harvests what you type next. If you clicked and didn’t enter anything, close the tab, clear site data for that domain, and run Safe Browsing/VirusTotal on the URL to see if it was flagged. If you entered password/2FA, change it immediately on the real site and sign out everywhere.

What’s the safest way to handle links on my phone?

On phone there’s no hover — long-press the link → Copy link → paste into Notes (don’t open) → read domain right-to-left and check for https and xn--. Then paste the copied URL into Safe Browsing or VirusTotal via a new tab. For actions (bank, Microsoft), don’t go via the link at all — open the app or type the domain yourself.

Should I use a link checker or VirusTotal for every link?

For expected links from known senders (colleague with context), hover + right-to-left is enough. For unexpected, external, or urgent links (especially with shorteners or you didn’t request), always expand and check Safe Browsing + VirusTotal — it adds 10 seconds and your device never touches the payload. Our preview at Toolwasp does hover → expand → check locally.

Last updated: September 2, 2026 • Author: Toolwasp Team • Sources verified Sep 2, 2026: Google Safe Browsing Search, Safe Browsing, Safe Browsing API, PhishTank, VirusTotal URL, MDN What Is a URL, CISA Recognize & Report. More safety guides at Toolwasp.