# How to Spot a Phishing URL Before You Click (in 10 Seconds) > Phishing URLs are designed to look real at a glance. The 6 things to look for in the domain (lookalike characters, extra subdomains, wrong TLD, mismatched display vs. actual URL, suspicious path, and URL-encoded junk) take 10 seconds to scan. Here is the checklist, with worked examples. URL: https://uttir.com/blog/how-to-spot-a-phishing-url-before-you-click Published: 2026-08-20 Author: Uttir Reading time: 6 min Tags: security, phishing, url, how-to, cybersecurity ## Quick answer Look at the domain (the part right before the first single slash). Six things to check: (1) the exact spelling of the brand name (paypaI.com with capital i is not paypal.com), (2) the TLD (.com vs .co vs .ru-paypal.com), (3) extra subdomains before the real domain (paypal.com.secure-login.xyz), (4) the actual URL behind a link (hover on desktop, long-press on mobile), (5) the path (look for hyphens and weird slashes), and (6) URL-encoded junk (%20, %2F, %3D where spaces and slashes should be). If any of these look off, do not click. The [URL Decoder](/url-decoder) on this site unmasks what an encoded URL actually points to; the [WHOIS Lookup](/whois-lookup) shows who actually registered the domain. Phishing is a volume game. The attacker sends 10 million emails, gets 0.1% to click, and harvests credentials from 10,000 people. The click is the moment the whole thing succeeds or fails. The 10 seconds you spend looking at the URL before clicking is the cheapest, most effective defense you have. This is the 6-point checklist. After you have read it once, you will scan URLs in 10 seconds or less. It is faster than reading a paragraph of anti-phishing advice because the eye learns to jump to the parts that matter. ## 1. The lookalike character (the #1 trick) The most common phishing trick is one character that is visually similar to a real character. The classic examples: - `paypaI.com` (capital I instead of lowercase l) - `paypаl.com` (Cyrillic 'а' instead of Latin 'a') - `amaz0n.com` (zero instead of letter O) - `microsft.com` (missing letter, easy to miss) - `app1e.com` (digit 1 instead of letter l) On a desktop, hover over the link to see the actual URL in the status bar. On a phone, long-press to preview the URL. The address bar at the top of the browser also shows the real URL — and on every modern browser, the domain is highlighted in black while the rest of the URL is gray. Read the black part, not the gray part. The lookalike trick works because most people read the SHAPE of a word, not the individual characters. Your brain sees "paypal" because the shape is right, even if the actual characters are "paypaI". This is exactly the trick that makes phishing effective. ## 2. The wrong TLD (the .com vs .co trick) The TLD is the last part of the domain — .com, .net, .org, .co, .io, .ru, .xyz. The real paypal.com is at .com. A phishing site might be at paypal.co, paypal.com.co, paypal-customer-service.com, or paypal-support.net. The brand is right, the TLD is wrong. Lookalike TLDs are especially common because attackers register hundreds of TLD variants of brand names. They will register paypal.co, paypal-support.com, paypal-login.com, and paypal-help.net, and rotate between them as the legitimate ones get taken down. If you are on a legitimate-looking site that asks for credentials, check the TLD against what the brand actually uses. You can find out what TLDs a brand uses by visiting their official site. If paypal.com is the real domain, and you are on paypal-help.com, that is not the real domain. ## 3. The subdomain trick (the biggest visual lie) This is the trick where the attacker makes a long URL that contains the real brand as a SUBDOMAIN, with their own domain as the actual domain. The classic: - `paypal.com.secure-login.xyz` — the real domain is `secure-login.xyz`, not `paypal.com` - `accounts.google.com.verify.badactor.ru` — the real domain is `badactor.ru` - `amazon.signin.security-check.com` — the real domain is `security-check.com` To read this correctly, find the LAST dot before the TLD. The part immediately to the left is the actual domain. Everything else is a subdomain. In `paypal.com.secure-login.xyz`, the actual domain is `secure-login.xyz` (not `paypal.com`). The trick works because the URL is long, and the brain latches onto the first recognizable word and assumes everything after is also trustworthy. Modern browsers strip the subdomain for display in the address bar, so the URL bar will show `secure-login.xyz` as the actual domain. If you only ever see the "paypal.com" part in your brain but the address bar shows `secure-login.xyz`, that is the giveaway. ## 4. The display text vs. actual URL mismatch In HTML, a link can have a display text that is different from the actual URL. So a link can say "Click here to log in to your PayPal account" but actually point to a phishing site. On desktop, hover over the link to see the real URL in the status bar. On mobile, long-press the link to see the URL in a popup. Attackers use this trick because the brain is lazy. If the visible text matches what the user expects, the user clicks without checking the actual URL. The fix is to ALWAYS check the actual URL, never the display text. A legitimate link to your bank will display the bank's URL. A phishing link will display the bank's URL but actually point somewhere else. ## 5. The suspicious path (the part after the domain) The path is everything after the domain: `/login/verify/account` or `/sign-in?return=secure`. Some patterns to watch for: - **Extra hyphens and slashes**: `/secure/login/account/verify/sign-in/` — legitimate services rarely have 5-deep URL paths. They use one well-known URL like `/login` and call it good. - **Long random strings**: `/a/8f3b2c1d9e/verify` — the random string is a tracking ID. Legitimate services use recognizable paths, not random strings. - **URL-encoded characters in the path**: `/%2Fsecure%2Flogin` — the browser may not show these as encoded, but they are. The [URL Decoder](/url-decoder) on this site will show you what they mean. - **Domain in the path**: `/paypal.com/login` — putting a brand name in the path is a common phishing technique. ## 6. URL-encoded junk (the obfuscation layer) Phishing URLs often include URL-encoded characters to hide the destination. The [URL Decoder](/url-decoder) on this site will show you what an encoded URL actually means. Common obfuscations: - `%2F` = `/` — encoded slash, used to hide a path - `%2E` = `.` — encoded dot, used to hide a domain - `%3A` = `:` — encoded colon, used to hide a port - `%40` = `@` — encoded at-sign, used to confuse the URL parser - `%00` — null byte, used to break URL parsers in some browsers If you see percent signs in a URL, the link is probably trying to hide something. Paste it into the [URL Decoder](/url-decoder) to see the decoded form. ## The 10-second scan (the full checklist) When you are about to click a link — especially a link that asks for a password — run this checklist in 10 seconds: - Hover the link. Read the actual URL in the status bar (or the address bar after clicking). - Find the actual domain. It's the part right before the TLD, ignoring any subdomains. - Check the spelling of the actual domain. Look for lookalike characters (capital I, zero, Cyrillic letters). - Check the TLD. Is it the one the brand actually uses? - Check the path. Is it a short, recognizable path? Or is it long, with random strings, hyphens, and slashes? - Check for URL-encoded characters. If you see `%20` or `%2F` where you would expect a space or slash, paste the URL into the [URL Decoder](/url-decoder). If any of these look off, do not click. If everything looks fine, click. The 10 seconds is the cost of staying safe; the cost of clicking a phishing link is your account, your money, or your identity. ## What to do if you already clicked If you clicked a phishing link but did not enter credentials: you are probably safe. The link alone is not enough — the attacker needs you to type a password or download a file. Close the tab. Do not enter anything. Run a malware scan if you are paranoid. If you entered credentials: change the password immediately, from a DIFFERENT device if possible (in case the phishing site installed a keylogger). Enable two-factor authentication if the service supports it. Check the account's login history for any access you don't recognize. If the password is reused anywhere (email, banking, social), change those too. The 6 password mistakes post on this site has more on the reuse problem. ## What to do if you want to verify a URL If a URL looks suspicious but you are not sure, three tools on this site can help: - The [URL Decoder](/url-decoder) will show you what an encoded URL actually points to. If a URL has `%2F` in it, paste it in to see the unencoded form. - The [WHOIS Lookup](/whois-lookup) will show you who actually registered the domain. If `paypa1.com` is registered to "John Smith in Belarus" instead of "PayPal Inc.", that is a phishing site. - The [DNS Lookup](/dns-lookup) will show you what server the domain actually points to. If a "PayPal" URL points to a server in a different country, that is also a phishing site. None of these tools are a substitute for the 10-second scan, but they are useful when a URL is ambiguous and you want a second opinion before clicking. ## The honest summary Phishing is a 10-second problem. The 6-point checklist — lookalike character, wrong TLD, subdomain trick, display text vs. actual URL, suspicious path, URL-encoded junk — takes less time than reading this paragraph. Run it before clicking any link that asks for a password. The attacker has 10 million emails and 0.1% click-through; the 10 seconds you spend on the URL is the difference between being in the 0.1% and being in the 99.9%. The [URL Decoder](/url-decoder) on this site unmasks encoded URLs; the [WHOIS Lookup](/whois-lookup) shows who actually registered the domain. None of them replace the checklist, but they help when the URL is ambiguous. ## Related tools - [URL Decoder](https://uttir.com/url-decoder) — Decode percent-encoded URLs and query strings back into readable text. - [URL Encoder](https://uttir.com/url-encoder) — Percent-encode text for safe use in URLs — as a query value or a full URL. - [WHOIS / RDAP Lookup](https://uttir.com/whois-lookup) — Look up domain or IP registration info via RDAP. Registrar, status, dates, nameservers, contacts. Free, runs in your browser. - [DNS Lookup](https://uttir.com/dns-lookup) — Query DNS records (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA) for any domain using Google DNS-over-HTTPS. - [Password Strength Checker](https://uttir.com/password-strength-checker) — See how strong a password really is — entropy, time-to-crack, and a list of issues, all computed in your browser. --- For the full HTML article, visit https://uttir.com/blog/how-to-spot-a-phishing-url-before-you-click. This file is the markdown rendering at https://uttir.com/blog/how-to-spot-a-phishing-url-before-you-click.md. See https://uttir.com/llms.txt for a site-wide summary.