# How to check if a link is safe before you click it

URL: https://iblockspam.com/blog/how-to-check-if-a-link-is-safe
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Phishing & threats
Author: iBlockSpam Team

> Check a link without clicking: preview it, find the real domain, spot subdomain and punycode tricks, read shortened and Safe Links URLs, and what not to do.

## Short answer

Preview the link without clicking: hover on a computer, or press and hold on a phone. Find the real domain, the name just before the first single slash, and check it belongs to the organization. Distrust shorteners, odd characters and xn-- names. If the message might be real, ignore the link and type the site's address yourself.

Most phishing still needs one thing from you: a click. The good news is that a link tells you a lot before you open it, if you know where to look. This guide shows how to preview a link on a computer and a phone, how to read the real domain, which tricks hide it, how to read links your company's security tools have rewritten, and how to check a link without visiting it.

## How do you preview a link without clicking it?

Start by seeing where the link really goes. The words or button you see can say anything.

- **On a computer:** Microsoft's advice is to "hover your mouse over, but don't click the link. Look at the address that pops up when you hover over the link" ([Microsoft Support](https://support.microsoft.com/en-us/security/protect-yourself-from-phishing)). In most mail apps and browsers it appears at the bottom of the window or in a small tooltip.
- **On Android:** Microsoft says to "long-press the link to get a properties page that will reveal the true destination of the link."
- **On iPhone and iPad:** Microsoft suggests what Apple calls a "Light, long-press." A preview card shows the address. Don't tap the preview itself.

If the preview doesn't match what the text claims, stop there. A button that says "View invoice in QuickBooks" but points to an unrelated domain is enough of an answer.

## How do you read the real domain in a link?

A web address has several parts, and only one of them tells you who owns the site.

| Part | Example | What it tells you |
|---|---|---|
| Scheme | `https://` | How your browser connects. Not who runs the site |
| Host name | `login.microsoftonline.com.secure-check.example` | The full name of the server |
| Registered domain | `secure-check.example` | Who owns the site. This is the part to check |
| Path | `/reset/account` | A page on that site. Anyone can type any words here |
| Query | `?user=you&ref=mail` | Extra data. Often long, often meaningless |

The rule: **find the first single slash after the `//`, then read the host name right to left.** The registered domain is the last two labels, or three for country endings such as `.co.uk`. Everything to its left is a subdomain, and the domain's owner can make subdomains say anything they like.

### Tricks that hide the real domain

**Subdomain stuffing.** `microsoft.com.account-verify.example` belongs to `account-verify.example`. The familiar brand on the left is decoration. The same trick appears as `paypal-secure.example` or `microsoft365-support.example`: a brand name plus a word, on a domain the brand doesn't own.

**The @ trick.** Anything before an `@` in the host part is treated as a user name and ignored. [RFC 3986, section 7.6](https://www.rfc-editor.org/rfc/rfc3986.html#section-7.6) gives a classic example: `ftp://cnn.example.com&story=breaking_news@10.0.0.1/top_story.htm` "might lead a human user to assume that the host is 'cnn.example.com', whereas it is actually '10.0.0.1'." If you see an `@` before the first single slash, distrust the link.

**Raw IP addresses.** A link to `http://203.0.113.45/login` has no domain at all. Real companies don't send customers to bare IP addresses.

**Lookalike spelling.** One changed character: `rnicrosoft.com` for `microsoft.com`, a zero for an "o", or an extra hyphen. Our guide to [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing) covers the patterns attackers use.

**Mismatched link text.** The link's visible text can itself look like a web address, such as `https://www.yourbank.com`, while the real target is somewhere else. Always preview; never trust visible text.

### Punycode and homograph domains

Domain names can contain non-Latin characters. Behind the scenes, these internationalized names are stored in an ASCII form that starts with `xn--`, often called punycode. The Chromium project's [IDN documentation](https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md) explains the risk: "the Latin "a" looks a lot like the Cyrillic "а"," so someone can register a name that looks identical to a famous one.

Browsers defend against this. Chrome decides for each part of a host name whether to show Unicode or punycode. If a label mixes scripts, for example Latin with Cyrillic, or looks confusable, Chrome shows the `xn--` form instead. So in Chrome, `micrоsoft.example` written with a Cyrillic "о" would appear as `xn--micrsoft-qbh.example`.

Two practical rules follow:

1. If a link from an email shows `xn--` anywhere in the host name and you weren't expecting a non-English domain, treat it as hostile.
2. A mail app may not apply the same checks as Chrome, so its link preview could show the lookalike Unicode form. When in doubt, don't use the link; type the address you know.

## What about shortened links and QR codes?

URL shorteners turn a long address into something like `short.example/x7Kq2`. They have legitimate uses, but they hide the destination, which is why [CISA](https://www.cisa.gov/secure-our-world/recognize-and-report-phishing) lists "untrusted shortened URLs" as a warning sign. A preview tells you only that the link goes to the shortener.

- Treat a shortened link in an unexpected email as unverified.
- Some shortening services offer a preview page that shows the destination before redirecting. Use it only if you know the service, and still check the destination domain.
- Admins on Google Workspace can turn on **Identify links behind shortened URLs** in Gmail's safety settings; see our guide to [Google Workspace advanced phishing and malware protection](https://iblockspam.com/blog/google-workspace-advanced-phishing-malware-protection).

QR codes hide the link in an image and move the click to your phone. The same checks apply once you scan, but the safer habit is not to scan codes in unexpected emails at all. Our guide to [QR code phishing](https://iblockspam.com/blog/qr-code-phishing-quishing) explains why.

## How do you read links rewritten by Safe Links or a gateway?

In many businesses, every link in incoming mail is rewritten so it can be checked again when someone clicks. That changes what you see when you preview.

### Microsoft Defender for Office 365 Safe Links

Microsoft says scanned URLs are "rewritten or *wrapped*" using a prefix like `https://nam01.safelinks.protection.outlook.com` ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/safe-links-about)). When you click, Safe Links checks the URL before opening the site and shows a warning page if it's known to be malicious. In Outlook, Microsoft says that when a user hovers over a URL, "a pop-up dialog displays the original URL, indicating it was scanned by Safe Links."

If you see the raw wrapped address in another app, the original destination is inside it, URL-encoded, in the `url=` parameter. Decode it in your head: `%3A%2F%2F` is `://` and `%2F` is `/`. Then apply the same domain check as before.

Two things to remember:

- **A wrapped link isn't a verdict.** It means the link will be checked at click time, not that it's safe. Microsoft gives the example of a link that "was legitimate on delivery, but was later weaponized."
- **Never trust a Safe Links prefix you can't place.** Attackers know users trust these prefixes. Microsoft's own documentation notes that "default Microsoft warning pages are often used by attackers," which is why it suggests organization branding on the real ones.

For admins, our guide to [Safe Links and Safe Attachments](https://iblockspam.com/blog/microsoft-365-safe-links-safe-attachments) covers the settings that matter.

### Other gateways and filters

Other email filters rewrite links in a similar way, with their own prefix and an encoded original URL. The same rules apply: find the original domain inside the wrapper, and treat the wrapper as a time-of-click check, not a guarantee. If links in your company's mail look like a security service you don't recognize, ask IT what your filter's rewritten links look like, so you can spot a fake.

## How can you check a link without visiting it?

If the preview leaves you unsure, there are safer ways to check than clicking.

1. **Go around the link.** This is the advice every agency gives. The FTC says to contact the company "using a phone number or website you know is real — not the information in the email" ([FTC](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams)). Microsoft suggests going to the organization's site "from your own saved favorite, or via a web search." CISA says to type the address yourself. If the message was real, whatever it wants you to see will be there when you sign in normally.
2. **Copy, don't click.** Right-click or long-press and copy the link address. The UK's NCSC, in its scam-website reporting guidance, says: "Do not click on the suspicious link. Carefully copy and paste it, or write it down on paper first if that feels safer" ([NCSC](https://www.ncsc.gov.uk/section/about-this-website/report-scam-website)).
3. **Check its reputation.** Paste the copied address into a URL reputation service. Google's [Safe Browsing](https://developers.google.com/safe-browsing) lists of "unsafe web resources" cover phishing and malware sites, and Google's Transparency Report has a public site-status search built on them. A clean result only means the site isn't on a list yet. New phishing sites often aren't.
4. **Check the sender.** Paste the message headers into our [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer), which runs in your browser, to see where the message really came from and whether SPF, DKIM and DMARC passed.
5. **Ask.** At work, forward it to IT or use the report button. In the UK, the NCSC accepts reports of suspicious websites and emails.

## What shouldn't you do with a suspicious link?

Some well-meant habits make things worse.

- **Don't "test" it.** Opening a link to see what happens is the click the attacker wanted. A page can start a download, show a convincing sign-in form, or confirm that your address is live and worth targeting again.
- **Don't rely on a private or incognito window.** It doesn't sandbox the page. It only forgets your history afterward.
- **Don't sign in after following an email link,** even if the page looks perfect. Close it and open the service yourself.
- **Don't forward a suspicious link to colleagues to ask whether it's safe.** Forward the whole message to IT or use the report button, so the person checking sees the headers too.
- **Don't trust the padlock.** HTTPS means the connection is encrypted, not that the site is honest.
- **Don't click "unsubscribe" in an obvious scam.** CISA lists this explicitly. See [is it safe to unsubscribe from spam](https://iblockspam.com/blog/is-it-safe-to-unsubscribe-from-spam).

## A 6-step link check

Use this whenever an email asks you to click.

1. Was I expecting this message and this link?
2. Hover or long-press. Does the preview match what the text claims?
3. Find the first single slash. Is the registered domain the organization's real domain?
4. Any `@` before the slash, an IP address, `xn--`, a shortener or a misspelling?
5. Is the link asking me to sign in, pay or download something? If so, go to the site myself instead.
6. Still unsure? Copy the address, check its reputation, and report the message.

If you've already clicked and typed a password, don't wait. Follow [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link) and tell IT straight away.

## Next steps

- Share the 6-step check with your team, alongside our guide on [how to spot a phishing email](https://iblockspam.com/blog/how-to-spot-a-phishing-email).
- Agree one way to report suspicious messages; our guide to [reporting phishing emails](https://iblockspam.com/blog/report-phishing-email) covers Outlook, Gmail and Apple Mail.
- Find out whether your email filter rewrites links and what the rewritten links look like, so staff can recognize the real thing.
- Fewer bad links in inboxes means fewer judgment calls. iBlockSpam filters phishing and spoofing at the MX level, before mail reaches any mailbox; see [how it works](https://iblockspam.com/how-it-works).

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### Is a link safe if it starts with https and shows a padlock?

No. HTTPS only means the connection to the site is encrypted. It says nothing about who runs the site. Criminals can get certificates for their own domains easily, so a phishing page can show a padlock too. Judge a link by its domain, not by the padlock or the https prefix.

### What does xn-- mean in a web address?

A name starting with xn-- is the encoded form of an internationalized domain name, one that contains non-Latin characters. Browsers such as Chrome show this encoded form when a name mixes scripts or looks confusable, to defeat lookalike tricks. If a link from an email shows xn--, treat it as suspicious.

### Can I open a suspicious link in a private or incognito window to check it?

No. A private window doesn't isolate you from the site. It only stops your browser keeping history and cookies afterward. The page can still try a download, show a fake sign-in form or record that your address clicked. Use a reputation check on the copied address, or report the message instead.

### Why do links in my work email start with safelinks.protection.outlook.com?

Your organization uses Microsoft Defender for Office 365 Safe Links, which rewrites links so they're checked again when you click. Outlook usually shows the original address when you hover. A wrapped link isn't proof the destination is safe; it means it will be checked at click time.

### Is it safe to click a link from someone I know?

Not automatically. A colleague's or supplier's account can be hacked or spoofed, and the link then arrives from a familiar name. If the message is unexpected, asks you to sign in or pay, or feels slightly off, confirm with the person by phone or chat before you click.

## Sources

- [Microsoft Support: Protect yourself from phishing](https://support.microsoft.com/en-us/security/protect-yourself-from-phishing)
- [CISA: Recognize and report phishing](https://www.cisa.gov/secure-our-world/recognize-and-report-phishing)
- [FTC Consumer Advice: How to recognize and avoid phishing scams](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams)
- [NCSC (UK): Report a suspicious website](https://www.ncsc.gov.uk/section/about-this-website/report-scam-website)
- [RFC 3986: Uniform Resource Identifier (URI) Generic Syntax, section 7.6 (Semantic Attacks)](https://www.rfc-editor.org/rfc/rfc3986.html#section-7.6)
- [Chromium docs: IDN in Google Chrome](https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md)
- [Microsoft Learn: Safe Links in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/safe-links-about)
- [Google for Developers: Safe Browsing](https://developers.google.com/safe-browsing)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/how-to-check-if-a-link-is-safe (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt