Verify suspicious links before you click.
Scammers use deceptive URLs to lead you to phishing sites or trigger automatic malware downloads. They often use URL shorteners or 'Lookalike Domains' to hide the true destination of a link and bypass your natural suspicion.
Security Insight
Over 90% of cyberattacks begin with a single malicious link. By clicking a link, you may be providing scammers with your IP address, device information, and a confirmation that your email address is active and vulnerable.
How to spot a Malicious URL
A link's display text can be completely different from its actual destination. Watch out for these specific technical red flags before interacting with any unsolicited link.
The 'Shortened URL' trap
The 'Lookalike' Domain trick
Double-Dot or IP Address links
Automatic 'File Download' links
What IsThisSpam checks before you trust a sender
Quick verdicts are useful, but the real value is understanding why something looks safe, uncertain, or risky.
Unusual TLDs
Be wary of links leading to .xyz, .top, .ga, or .tk. These extensions are cheap and frequently used by massive phishing campaigns.
Subdomain Confusion
A link that says 'paypal.verification-portal.com' actually leads to 'verification-portal.com', not PayPal.
The 'Hidden' URL
When you hover over a link, the URL shown in the bottom corner of your browser doesn't match the text of the link itself.
Protocol mismatch (http vs https)
While many scam sites now use https, an 'Official' bank link that only uses http is a guaranteed red flag.
Related guides
Use the checker for the fast answer, then read the deeper guidance for recurring scam patterns.
Scam Website Checker
SMS Scam Checker
FAQ
These are the questions people usually ask right before they click, reply, or pay.
Got a screenshot or attachment? Our AI can analyse it.
Check the sender before you trust the message.
Start with a fast scan, then move to SuperScan when the message involves money, account access, or sensitive documents.