How to Check a Link for Phishing (Without Opening It)

Q: Where do I report a phishing link in the US?

Forward phishing emails to reportphishing@apwg.org, forward phishing texts to SPAM (7726), and file a report at ReportFraud.ftc.gov. If the link uses a short link service, report it to that service as well so it can be disabled.

The short answer

You got a link in an email, text or DM, and something feels off. Here is how to check a link for phishing without opening it: find the real domain, expand it if it is a short link, run it through a scanner, and then confirm the request through a channel you already trust.

That last step matters more than the others. A link can pass every scanner and still be a trap, because brand-new phishing pages often are not on any blocklist yet. So treat tools as a filter, not a verdict.

The rest of this guide walks through each step, with a worked example you can copy.

Step 1: See the real address before you do anything

The text you see in a message is not always where the link goes. "Track your package" or even "www.yourbank.com" can point anywhere. You need the actual address underneath.

On a computer: hover your mouse over the link without clicking. The real address shows in the bottom corner of your browser or email app.
On an iPhone or Android phone: press and hold the link. A preview or menu appears with the full address. Choose "Copy link" instead of opening it.
In a text message: the address is usually shown in full, but it may be a short link. Press and hold to copy it.

Paste the copied address into a plain note or text editor. Now you can read it slowly, which is the whole point.

Step 2: Find the part of the domain that actually matters

This is the step most people skip, and it catches the majority of fake links. Scammers count on you reading a URL from left to right and stopping once you see a familiar name.

Read it the other way. Find the first single slash after https://. Everything before that slash is the host. Now look at the last two parts of the host, the name and the ending, like amazon.com or chase.com. That pair is the registered domain, and it tells you who owns the site. Anything to the left of it is a subdomain, which the owner can set to any word they like.

Worked example

Say a text tells you your account is locked and gives this link:

https://paypal.com.secure-login-check.help/verify

Left to right, it starts with "paypal.com," which looks fine. Right to left, the host ends in secure-login-check.help. That is the registered domain. "paypal.com" here is just a subdomain the scammer typed in. This link does not belong to PayPal.

Compare it with https://www.paypal.com/myaccount. The host ends in paypal.com, so the owner is PayPal.

Other tricks to look for in the domain

One letter swapped or added: "arnazon" for "amazon" (an r and n look like an m at small sizes), or "paypa1" with a number one.
Extra words: "chase-support-alerts.com" is not chase.com.
An odd ending: a big US bank or retailer using a strange ending you have never seen with that brand.
A raw number address: a link like http://192.0.2.44/login instead of a name. Real companies almost never send these.
Lots of %-codes: some links hide characters with URL encoding, so a domain is hard to read at a glance. If you cannot tell what the domain is, treat it as a no.

One thing that does not prove safety: the padlock or "https." It only means the connection is encrypted. Scam sites get free certificates too, so a phishing page with https is still a phishing page.

Step 3: Expand short links before you judge them

Short links hide the destination by design. That is useful for a printed flyer and handy for a scammer. You cannot hover over bit.ly or a Freeurl link and learn anything useful, so expand it first.

Paste it into our free unshorten tool. Here is what happens behind the scenes, so you know what you are trusting:

Our server asks the short link where it goes, then follows every redirect until it reaches a normal page.
It reads only the headers each server sends back, not the page itself. Nothing runs on your device and your browser never opens the site.
You see each step with its status code (301 or 308 for a permanent move, 302 or 307 for a temporary one, 200 for the final page), the full final address, and a safety check.

Then apply Step 2 to the final address. That is the domain that counts, not the short link domain.

A few honest limits: the tool will not open private or internal addresses, pages behind a login, or sites that block automated visitors. When that happens, it tells you why. And password-protected Freeurl links keep their destination hidden until the password is entered. If you cannot see where a link ends up, that is a reason to be more careful, not less.

If the short link is a Freeurl link, you can also add a plus sign to the end, like freeurl.co/abc123+, to see its public stats. The analytics checker does the same for links you own. For other services, our guide on checking a Bit.ly link before you click it covers the details.

Step 4: Run the final address through a scanner

Once you have the real destination, check it against known threat lists. Two free options:

Google Safe Browsing site status: the Transparency Report lookup lets you paste a site and see whether Google currently flags it as dangerous, without visiting it.
Freeurl's result page: the unshorten result includes a safety check alongside the redirect chain, so you can see both in one place.

Paste the final address, not the short one. If a scanner flags it, stop there. Do not open it "just to see."

Why a clean scan is not a green light

Here is the trade-off most guides skip. Scanners work from lists of sites already reported or detected. A phishing page set up this morning may not be on any list yet. A clean result means "not known to be bad," which is different from "known to be good."

So if Step 2 already looked wrong, trust Step 2 over the scanner.

Step 5: Check the message, not just the link

The link is only half the evidence. The message around it often gives the game away. The FTC's guide to phishing lists the stories scammers use: suspicious login attempts, a problem with your payment details, an invoice you do not recognize, a refund you supposedly qualify for, or a free coupon.

Ask yourself:

Do I actually have an account with this company, or know this person?
Was I expecting this message?
Does it push me to act right now or something bad happens?
Does the sender's real email address match the company's domain, or just the display name?
Is it asking me to log in, pay, or confirm personal details through the link?

The FTC is direct on that last point: real companies will not email or text you a link to update your payment information.

Step 6: Go around the link

This is the check that works even when everything else is inconclusive. If the message says your bank account is locked, close the message. Open your bank's app, or type the bank's address yourself, and log in there. If there is a real problem, you will see it.

The same works for a coworker's "shared document" link. Message them on a separate channel and ask if they sent it. It takes ten seconds and avoids guessing.

What to do if you already clicked

Clicking alone is not always the end of the world, but act quickly, especially if you typed anything in.

If you entered a password: change it right away on the real site, and anywhere else you reused it. Turn on multi-factor authentication.
If you shared card, bank or Social Security details: go to IdentityTheft.gov for step-by-step recovery based on what you lost.
If a file downloaded: update your security software and run a full scan.
On a work device: tell your IT team now. They can check whether others got the same message.

How to report a phishing link

Reporting helps get the page taken down and warns others. The FTC recommends:

Forward phishing emails to the Anti-Phishing Working Group at [email protected].
Forward phishing texts to SPAM (7726).
File a report at ReportFraud.ftc.gov.

If the phishing link uses a Freeurl short link, report it to us and we will review and disable it if it breaks our rules.

A two-minute checklist you can save

Copy the link without opening it (hover, or press and hold).
Read the host right to left and find the registered domain.
If it is a short link, expand it and check the final domain.
Scan the final address. Treat a flag as a hard stop and a clean result as "not known bad."
Read the message for pressure, surprise invoices, and payment or login requests.
When in doubt, go to the company's site or app yourself.

If you run campaigns and share short links yourself, it is worth reading whether short links are safe from the reader's side. A branded domain and a clear destination make your links easier for people to trust. For links that arrive by text, see how to tell if a text message link is a scam.

Frequently asked questions

Can I check a link for phishing without clicking it?

Yes. Hover over the link on a computer, or press and hold it on a phone, and copy the address. Read the domain, expand it with an unshorten tool if it is a short link, and paste the final address into a scanner such as Google Safe Browsing site status. None of these steps open the page in your browser.

Does https or a padlock mean a link is safe?

No. The padlock only means the connection is encrypted. Scam sites can get certificates too, so a phishing page can show https. Check who owns the domain instead.

If a link scanner says a URL is clean, is it safe to open?

Not necessarily. Scanners check against lists of known bad sites, and new phishing pages may not be listed yet. A clean result means not known to be bad. If the domain looks wrong or the message pressures you, go to the company's site or app directly instead.

Where do I report a phishing link in the US?

Forward phishing emails to [email protected], forward phishing texts to SPAM (7726), and file a report at ReportFraud.ftc.gov. If the link uses a short link service, report it to that service as well so it can be disabled.