How to Check a URL for Phishing Indicators: The Complete Guide

The link looked completely normal.

The domain was correct. The padlock was present. The page loaded quickly and was absolutely identical to the login page that you have visited numerous times before. You entered your credentials. And then things started going wrong.

Phishing techniques have come a long way since the Nigerian Prince emails of the 1990s. Modern phishing attacks are highly sophisticated, often impossible to differentiate from normal communications, and able to evade many security solutions. There is, however, one exception: the URL itself is still giving away the game. You just need to learn how to spot it.

In this guide, you will learn how to conduct URL analysis for phishing indicators. We will go from basic knowledge about domain names all the way to detecting homoglyph attacks.

Why This Is Relevant Now More Than Ever

The figures are eye-opening. Microsoft detects more than 600 million identity-related threats daily. For 2024, the Internet Crime Complaint Center of the FBI estimates that there were losses of $16.6 billion, which is 33% higher year-over-year. Phishing attacks are the main source of intrusion into the system for most of these cases.

It’s not only the frequency but also the complexity that has changed. The use of generative AI makes it very easy for hackers to create convincing messages without errors and personalize them in large volumes. According to Darktrace, 70% of phishing emails now pass DMARC validation, i.e., they will look authentic even for the filtering software. Also, 41% of them are recognized as spear-phishing because they include targeted lures based on research.

The recommendations like “search for errors” or “look for the lock sign” are not helpful any more since hackers are adjusting. But there is something else that gives them away: it is the URL, the basic element of all web pages.

The Foundation: Understanding URL Structure

Before we can spot a fake, we need to understand what we’re looking at. A URL (Uniform Resource Locator) has several distinct components, and each one is a potential red flag.

Here’s the anatomy of a URL:

text
https://login.secure-banking.example.com/verify/account?id=12345

Breaking down:

Protocol: https:// HTTPS encrypts data in transit but doesn’t mean the website is legitimate. Phishing attackers can acquire a free SSL certificate in minutes.
Subdomain: login. secure-banking: Anything preceding the domain itself. Phishing attackers use multiple credible-looking subdomains to mislead the user.
Domain: example.com: It’s the name of the website. It’s the most important component of the URL and the only one identifying the true owner of the website.
Top-Level Domain (TLD): .com: The suffix. Some TLDs are abused a lot by phishers.
Path: /verify/account: A specific webpage on the website.
Query string: ?id=12345: Query parameters sent to the server.

The key point here: the domain is the only element that identifies the true owner of the website. All other components can be manipulated at will by any third-party.

The Basic Checks: A Step-by-Step Approach

Let’s start with a practical step-by-step approach. Whenever you get a suspicious link, go through the following steps in order:

Step 1: Hover Before Clicking

On the desktop, hovering over a link shows the actual URL in the status bar of your web browser. On the mobile phone, long-press the link to show the preview. Just by doing this, countless credentials have been saved.

What to check: Do the displayed text and the actual URL coincide? The hackers put the text saying “paypal.com,” while the actual destination URL is “paypal-secure.xyz.”

Step 2: Read the Domain Right-to-Left

Since humans read from left to right, we always focus on what comes first when reading something.

Think about the following example:

paypal.com.secure-login.xyz

From left to right, you would recognize “paypal.com,” and that is all. However, the real domain here is “secure-login.xyz,” whereas the previous one is its subdomain. And anybody can use any name as the subdomain.

The rule: Search for the last two dots. The text in between them will be the domain. This is what counts.

login.paypal.com → Domain = paypal.com ✓
paypal.com.login.xyz → Domain = login.xyz ✗

Step 3: Examine the TLD

There are some TLDs that are more common in phishing campaigns because they are inexpensive to buy or can be registered anonymously or because they belong to certain regions.

According to the Q4 2025 report of APWG, attackers frequently change their infrastructure providers. Some of the indicators are the following:

TLDs that can be registered for free or cheaply: .tk, .ml, .ga, .cf, .gq
Recently introduced TLDs: .xyz, .top, .club, .online (although many legitimate websites use these TLDs too)
TLDs that look similar to others: .cm instead of .com; .co instead of .com

It is not the strict rule because there are many legitimate businesses using .xyz. However, together with the above-mentioned warnings, it means that the risk increases.

Step 4: Search for Character Substitution

Phishing groups purchase domains that resemble the original ones on the first look:

paypa1.com (letter 1 instead of letter l)
arnazon.com (rn resembles m)
app1e.com (letter 1 instead of letter l)
g00gle.com (zeros instead of o’s)

Such domains are called typosquatting domains because people are not attentive when reading characters.

Step 5: Look out for Hyphens and Numbers

Hyphens and numbers should not be seen in legitimate domain names. For instance:

secure-paypal-login-verify.com (very suspicious)
paypal.com (legitimate)

The attacker joins the keywords using hyphens in order to create domains that include the name of the brand yet are different from the actual domain name.

The Advanced Corner: Uncovering Sophisticated Attacks

Basic tests can spot many phishing attacks. However, there are more advanced attacks that use techniques that cannot be discovered by visual inspection only.

Homoglyph Attack: “а” vs. “a”

Homoglyph is one of the most sophisticated phishing techniques, and that’s why you can’t always trust your vision.

A homoglyph is a character from another alphabet that looks exactly like some letter of the Latin alphabet. For instance, the Cyrillic “а” (U+0430) looks exactly like Latin “a” in any font.

This is how the attack works: a hacker purchases a domain like apple.com using the Cyrillic “а.” The hacker’s domain would look like apple.com in your browser’s address bar, that is, visually identical to apple.com. Meanwhile, DNS interprets this domain as a new domain.

The Punycode encoding shows the reality:

apple.com (Latin) → apple.com
apple.com (Cyrillic а) → xn--pple-43d.com

Protecting yourself: There are some browser-specific security measures against homoglyph domains, but these security measures differ from browser to browser. Chrome, Firefox, and Safari employ different policies as to when they show the Punycode version and when they show the Unicode version of a domain.

However, the most accurate method is to use a specialized detection utility. The Watch Glyph browser plug-in in particular is able to identify homoglyph and IDN spoofing by alerting users about domains that combine scripts or mimic brand names.

Failure to Pass the Browser’s IDN Exam

In response to the appearance of IDNs, the policy of ICANN says that browsers need to show Punycode for domains containing homoglyphs. However, the execution is far from perfect.

For Chrome, there is a special heuristic. Domains where different scripts are used inside one label (e.g., apрle.com, where “a” is Latin while “р” is Cyrillic) will show Punycode. But if a domain is made up of entirely Cyrillic symbols but looks like a Latin domain (apple.com), it will be shown as Unicode.

Each version of Firefox and Safari follows its own rules and changes them. Bottom line – there is no way to trust your browser with identifying homoglyph attacks.

URL Shorteners: A Mask for the Hidden Destination

When using services such as bit.ly, t.co, or tinyurl.com, you will only see a short and harmless-looking address, which leads to who-knows-where.

Here are the benefits for attackers:

They conceal the real domain
They look neat and professional
Security filters do not always track multiple redirects

According to the statistics of Q4 2025 by APWG, it is worth noting that attackers used TINYURL.COM for redirecting their QR codes.

What to do: Use an URL expander service before you click. Most online safety scanners resolve URL shortenings automatically for you. If you cannot find out where it goes, do not click on it.

Tools to Analyze URLs

Visual inspection has its limitations. This is how professionals analyze URLs, and now you know how to do it yourself.

Google Safe Browsing

Google’s Safe Browsing technology analyzes billions of URLs each day to detect potentially dangerous websites. Using the transparency report utility, you may check any URL against the constantly growing Google database.

The utility will tell you if the website has been marked as malicious or phishing, along with when the last time it was checked was. The tool is free, fast, and based on data collected by Google’s telemetry.

Drawback: a URL not contained in the database is not automatically safe. New phishing sites may start functioning and remain active for several hours before being identified.

VirusTotal

VirusTotal provides aggregated results from over 70 different security vendors into one report. You enter the URL, and it tests it against various threat intelligence databases, analyzes the content, and generates the report.

The API is well-documented, and there’s a web interface that allows doing this manually. For security specialists, VirusTotal is often the first choice when analyzing URLs.

PhishTank

PhishTank is a phishing URL verification website provided by Cisco Talos. Users can upload potential phishes, which are then verified through the process of voting by the community. Verified phishes are added to the PhishTank database.

The API can be used for automated verification of URLs with rate limiting restrictions in case of non-commercial use. With the API key, the quota of requests is increased.

LinkSentry: Command-Line Tools

For those who like using the command-line interface, there is a Python script called LinkSentry that utilizes machine learning to classify URLs.

Installation:

bash
pip install linksentry

Basic usage:

bash
linksentry check "https://suspicious-site.xyz/login"

The software analyzes 111 aspects of each URL in terms of character distribution, domain details, path analysis, and parameters. The Random Forest algorithm has been trained using more than 88,000 URLs.

To perform a detailed analysis using DNS, WHOIS and SSL checks:

bash
pip install linksentry[full]
linksentry check "https://example.com" --full

The confidence score is generated to allow an estimation of how reliable the test is.

Browser Extensions

There are some browser extensions that can offer you real-time protection:

Watch Glyph: Detects homoglyph/IDN attacks, identifies the faked brand name, works completely offline.
Unsitely: Detects the SSL validation status of the site, checks the age of the domain, detects redirection chains, AI-based behavioral factors, gives a trust score from 0 to 100.

This technology doesn’t mean that you can just skip learning about all the techniques behind them.

The Red Flags Checklist

If you’re looking at a URL, here is a checklist to go through:

Domain-related red flags:

The domain does not match the brand that it purports to represent

Multiple hyphens or digits in the domain name
Non-standard TLD (.xyz, .top, .tk, etc.) paired with brand impersonation
Recent registration of the domain (verify via WHOIS)
Homoglyph or typosquatting evidence

URL structure red flags:

Brand name included in sub-domain or in the URL path, not in the actual domain
Unusually long or complex
Uses encoded characters or other odd characters
URL is shortened to mask the destination
Mismatch between link text and actual URL

Contextual red flags:

Urgent unsolicited communication (“Your account will be terminated within 24 hours”)
Credentials or payments requested by the message
E-mail address does not match the alleged organization
Use of generic greeting
QR code received from an unexpected source (a popular attack vector nowadays)

Technical red flags:

Form action redirects to a different domain
SSL certificate is recently issued or issued to another organization
The page design is slightly off (but it’s increasingly unreliable for AI-generated sites)

What to Do if You Are Suspecting a Phishing Attack

Should the link you are looking at seem suspicious, here is how you should act:

Do not click on the link. This may seem like an obvious statement, but it is crucial, because simply visiting the phishing website can be enough for drive-by download and credential harvesting through the browser auto-fill option.

Check through official channels. If the sender claims to be your bank, contact the number printed on your card rather than the one mentioned in the email. Go to the website manually by typing the URL into the search bar.

Report the incident. You can do so through such websites as Google Safe Browsing, PhishTank, and IT/Security department within your organization. Should you have clicked on the link, change your credentials immediately. Also, activate MFA if it is not done yet, check the accounts for suspicious activity and report to the service provider.

Remove the message. No forwarding, replying and any other interaction with it.

Future of Phishing Detection

The game of cat-and-mouse carries on. Here is what is on the horizon.

Scalable attacks using AI. Generative AI has already started helping attackers create flawless grammar, context, and clones. One IEEE survey suggests that use of AI slashes the cost of running phishing campaigns by more than 95% while boosting their success rate.

Detection systems are keeping up. Modern AI-based detection systems have reached 99% accuracy rates with less than 2% false positives. The same AI technology used to attack is being used to defend against attacks.

Phishing-proof authentication. With the introduction of passkeys and hardware security keys, the industry is becoming phishing-proof through eliminating the use of passwords. Without any password to steal, phishing becomes useless.

The move from prevention to detection. According to Cisco Talos, 65% of incident response engagements now involve authentication abuses. Cybersecurity professionals know that it is not possible to stop every phishing email; hence the shift towards faster detection and response.

Main Insights

Now let’s summarize our findings and take them into consideration:

The domain is the key. Learn how to detect the true domain of every link. Start reading from right to left. Ignore subdomains and paths until you have checked the base domain.

HTTPS doesn’t imply safety. The lock is just an indication of secure connection and doesn’t confirm that a website is legitimate. It is used by phishing websites often.

Your web browser cannot protect you all the time. Homoglyph attack may be displayed properly on all popular web browsers. Consider using special detection software.

Check independently. Do not believe the URL. Enter the address directly or call the company by the phone. Report suspecting links. You don’t protect only yourself but the entire community. Stay updated. Phishing techniques change quickly. Methods used last year can no longer work today.

Next Steps

Now that you’ve learned a good method for URL evaluation, here’s what you need to do next:

Get a URL safety extension such as Watch Glyph or Unsitely to have real-time protection from harmful links.
Add Google Safe Browsing to your bookmarks to use this service for manual URL verification whenever necessary.
Start practicing reading domains when you receive an email with a link and make sure the actual domain is being used.
Pass this knowledge on to your friends, relatives, and colleagues who are not aware of these techniques yet.
Use MFA where possible, preferably, using phishing-resistant methods (such as passkeys).

Attackers are evolving. You are too if you use the right tools. The URL is still the sign just read it.

Conclusion

Phishing has come a long way since people started using typos in their emails and weird sender addresses. They now use homoglyph domains, convincing subdomains, and free SSL certificates to look authentic. However, URL reveals everything, and you need only to be able to understand it.

There is just one practice: always confirm whether the domain is correct, not subdomain or path. Always read URLs from right to left. You may use such services as Google Safe Browsing, VirusTotal or browser extensions for automatic checks. If you feel unsure, you may navigate to the website instead of following the link.

No technique alone is enough to be safe, but combined efforts are sure to cover all the gaps in security. Stay attentive and skeptical, and always verify.

Explore Our Cybersecurity Category. And if you are reading it up to here, leave a sweet comment to motivate us to write blog everyday.