How to Spot Suspicious URLs - 5 Checkpoints to Avoid Getting Tricked

Have you ever received a message on social media or email saying "Congratulations! You've won!" with a link attached? Most of these links are "phishing scams" designed to steal your personal information. The typical trick is to send you to a fake login page that looks just like the real thing, then get you to type in your ID and password.

But don't worry. If you know how to read a URL, you can spot suspicious links with a pretty high success rate. Let's learn the 5 checkpoints.

If you see a padlock icon in your browser's address bar, the connection to that site is encrypted. The URL should start with "https://". Encryption means the data exchanged between you and the site is scrambled so no one else can read it. Think of it like putting your letter in a sealed envelope.

On the other hand, sites with "http://" (no "s") are not encrypted. It's like sending a postcard where anyone can read the contents. If a page asks for your password or credit card number and it's http, never enter your information.

One important caveat, though: https doesn't automatically mean "safe site." Scam sites can use https too. The padlock means "the connection is encrypted" - not "the site owner is trustworthy." Even if the letter is in a sealed envelope, it doesn't help if the sender is a scammer.

The most important part of a URL is the domain name. The trick is to read it from right to left.

For example, with "login.amazon.co.jp," read from right: "jp - co - amazon - login." The core domain is amazon.co.jp, so this is a real Amazon page.

But what about "amazon.login-security.com"? Reading from right: "com - login-security - amazon." The core domain is login-security.com, which has nothing to do with Amazon. Even though the word "amazon" appears in the URL, if the core domain is different, it's a fake. This is the most important point to remember.

Shortened URLs (short links like bit.ly/xxxxx) don't reveal their destination just by looking at them. While convenient, they can also be used to hide the entrance to malicious sites.

If you receive a shortened URL from someone you don't know, check the real destination using a "URL expander" before clicking. Our free Short URL Expander shows the redirect path and the final destination without opening the link. Make it a habit to look at the destination URL first, then decide whether it's safe.

Scam links come paired with words designed to push your emotional buttons.

• "Get it free! Click now!"
• "You've won 1 million dollars!"
• "Your account will be suspended. Verify within 24 hours."
• "Unauthorized access detected. Change your password immediately."

These phrases are meant to rush you so you can't think clearly - that's the scammer's playbook. Legitimate services almost never threaten you with "click now or something terrible will happen." The more panicked you feel, the more important it is to stop and check the URL.

As practice, compare these made-up URLs.

• ✅ https://www.amazon.co.jp/dp/B08N5WRWNW (real structure)
• ❌ https://www.arnazon.co.jp/dp/B08N5WRWNW (the "m" has been replaced with "rn")
• ❌ https://amazon-login.security-check.com/verify (the core domain is security-check.com)

The second one is hard to catch unless you look carefully. Lowercase "m" and "rn" look nearly identical in some fonts. The third one contains the word "amazon," but reading from right, the core domain is a completely different site. These "lookalikes" are commonly used in real phishing scams, so stay alert.

1. Look for the padlock (https) 2. Read the domain name from right to left to identify the real domain 3. Expand shortened URLs before clicking 4. Don't panic over "free," "winner," or "urgent" 5. Watch out for lookalike characters

Just remembering these 5 points will help you avoid a lot of trouble online. Share them with your friends and family too.