VerigrityVERIGRITY GUIDE
10 Suspicious URL Signs to Watch For
Most phishing and scam links are not technically sophisticated. They rely on small visual tricks — a swapped letter, an extra word, a misplaced dot — that disappear if you skim too quickly. Here are ten URL patterns worth slowing down for, why each one matters, and how to read them without needing to be a security expert.
First — read URLs from right to left
Most people read a URL left to right and stop at the first familiar word. Attackers exploit this. The part of a URL you should read first is the domain — the label immediately to the left of the final dot and the top-level domain (.com, .org, .co.uk, etc.). Everything before that is a subdomain, and everything after the first single slash is a path. Subdomains and paths can be freely named by the site owner, so a scammer can register paypal.com.security-check.example.net and the URL will still show "paypal" first.
The rule: find the last dot before the first slash. The word to its left is the domain. That's the real site.
The ten warning signs
1. A brand name in the subdomain instead of the domain
Example: paypal.com.secure-login.ru
The domain here is secure-login.ru. paypal.com is just a subdomain the attacker chose to name it. This is one of the most common phishing patterns and it works because the eye lands on "paypal.com" first. Check the segment immediately before the TLD — that's the site you're actually visiting.
2. Homograph and look-alike characters
Example: rnicrosoft.com (rn instead of m), paypa1.com (the number 1 instead of letter l), g00gle.com (zeros instead of o).
Attackers register domains that differ from a real brand name by one or two characters that are hard to spot at small font sizes. Other swaps: vv for w, 0 for O, I for l. Read the domain character by character if anything feels slightly off.
3. Punycode hostnames starting with xn--
Example: xn--pypal-4ve.com
Punycode is an encoding scheme that lets domains include non-ASCII characters — including Cyrillic, Greek, and Arabic letters that look identical to Latin ones. A Cyrillic "а" and a Latin "a" look the same but are different characters. Browsers used to display these as the intended Unicode look-alike, so аpple.com (with a Cyrillic а) would show as аpple.com and look legitimate. Browsers now show the raw xn-- prefix when a domain mixes scripts, which is a clear warning sign.
If you see xn-- at the start of a hostname, the domain contains non-ASCII characters. If the domain is claiming to be a major brand, this is almost certainly an attempt at a homograph attack.
4. Extra words like -login, -secure, -verify, -account
Example: example-account-verify.com
Legitimate brands rarely register domains that contain words like "verify," "secure," "account," or "login" as a suffix. These words are used by phishing kits because they sound like something a real company would send you to. The exception is when the domain itself is the brand name — example.com/login is fine; example-login.com is not.
5. Hyphens that split the brand name
Example: pay-pal.com, micro-soft.com, face-book.com
Legitimate brands almost never use hyphens inside their own name in a domain. If you see a hyphen breaking apart a well-known brand, treat the URL with suspicion until you can verify it independently.
6. Unusual top-level domains for a known brand
Example: paypal.cn, amazon.tk, microsoft.top
Brands typically register their domain in a small set of TLDs (.com, and often a regional variant like .co.uk or .de). If you see a well-known brand on a free or obscure TLD (.tk, .ml, .ga, .cf, .gq, .top, .xyz), assume it's not the brand — at least until you've verified it separately.
7. Credentials embedded in the URL
Example: https://paypal.com:secure@evil-site.com/
Before the @ symbol is a username; after it is the domain. This URL goes to evil-site.com, but the paypal.com:secure@ portion is designed to be read first. Any URL with an @ symbol in the hostname part is worth a hard second look. Modern browsers often strip or warn about these — but not always.
8. Deceptive path segments after the domain
Example: trusted-bank.com/secure.paypal.com/login
Here the domain is trusted-bank.com, but the path segment contains "paypal.com" to mislead you. Paths are freely named by the site owner and have no relationship to who actually owns the domain. Read the domain first, then check the path only if the domain checks out.
9. Long chains of subdomains
Example: secure.login.account.verify.example-attacker.com
Long chains of subdomains are a common pattern in phishing links. They push the real domain off the visible portion of the URL bar, especially on mobile. The domain here is example-attacker.com. Multiple layers of subdomain labels are almost never used by legitimate sites for login pages.
10. URL shorteners that hide the destination
Example: bit.ly/xY3k9p, t.co/aBcDeF
URL shorteners hide the real destination. That's the point — they exist to compress long URLs, but they also serve scammers because you can't see where the link goes until you click. Legitimate uses exist (Twitter, marketing campaigns), but if a link arrives from an unexpected source and is hidden behind a shortener, don't click it — expand it first (many shorteners offer a preview mode) or paste it into a URL checker.
How to check a URL before clicking
- Read the domain first. Find the last dot before the first slash. The word to its left is the site.
- Type the brand name directly. If an email claims to be from your bank, don't click the link — open a new tab and type the bank's address yourself.
- Hover before you click. On desktop, hovering over a link shows the true destination in the status bar. On mobile, long-press to preview.
- Expand shortened links. Many URL shorteners have a preview option, or use a checker like the Verigrity Link Safety Checker.
- Look for HTTPS as a baseline, not a green light. HTTPS is now standard on phishing sites too — its absence is a warning, but its presence doesn't mean the site is safe.
- Trust your hesitation. If anything about a URL feels off — an unusual TLD, a hyphen, an @ symbol, a subdomain that doesn't belong — stop and verify independently.
Frequently asked questions
Is HTTPS a reliable sign of a safe URL?
No. HTTPS encrypts the connection but doesn't verify who operates the site. Scam sites routinely use valid HTTPS certificates. The padlock means the connection is encrypted; it doesn't mean the site is honest.
What does the @ symbol mean in a URL?
Everything before an @ in a URL is treated as credentials (username:password), and everything after is the domain. Attackers abuse this by putting a familiar brand name before the @ to make the URL look like it belongs to that brand.
Are xn-- domains always malicious?
No. Some legitimate sites use internationalized domain names for non-Latin scripts — Chinese, Arabic, Cyrillic, and others. But if an xn-- domain visually mimics a well-known Latin-script brand, it's almost certainly an attempt at a homograph attack.
Can my browser protect me from these tricks?
Modern browsers do a reasonable job — they strip credentials from URLs, warn about punycode domains that mix scripts, and block known phishing sites via Safe Browsing. But they don't catch everything, especially brand-new domains. Human attention is still the last line of defense.
What should I do if I already clicked a suspicious link?
Don't enter any credentials, and don't download anything. Close the tab. If you already entered a password, change it on the legitimate site immediately, and enable two-factor authentication if you haven't. If you entered card details, contact your bank.