Phishing attacks succeed because they move faster than the people they target. A convincing link arrives in an inbox or surfaces in search results, and the gap between clicking and thinking is exactly where credentials get stolen. Six specific checks close that gap. Most take under 30 seconds. Together they catch the vast majority of malicious sites before you type a single character.
These checks scale with how suspicious a link seems. A link from a trusted contact with a domain you recognize needs only a glance. A link from an unknown sender, or one that arrived after an unusual event (a package you didn't order, a security alert you didn't trigger), deserves the full process.
Check 1: Read the Actual Domain
The registered domain is the piece of the URL directly to the left of the top-level domain (.com, .net, .org, and so on). Everything to the left of that is a subdomain, which anyone can set to any string they choose.
Consider: https://paypal.account-secure.com/login. The registered domain here is account-secure.com. PayPal appears only in the subdomain. A scammer controls that domain entirely and can put any text before the dot to make the URL look authoritative. Most people read URLs left to right and stop at the first familiar word, which is exactly the pattern attackers exploit.
Three specific patterns account for most URL deception:
- Subdomain impersonation:
apple.com.account-verify.netoramazon.com.checkout-help.co. The actual domain is whatever comes before the final TLD. - Typosquatting:
arnazon.com(lowercase r and n adjacent reads as m at small sizes),paypa1.com(numeral 1 for lowercase L),g00gle.com(zeros for the o's). These are nearly invisible on mobile screens without zooming in. - Punycode substitution: Unicode characters from non-Latin alphabets can look identical to English letters. A Cyrillic a is visually indistinguishable from a Latin a at standard screen sizes. Browsers counter this by displaying the punycode form (xn-- prefix) when a domain mixes character sets, so a spoofed
amazon.comusing a Cyrillic character would appear in the address bar as something likexn--mazon-1pb.com.
The check: Before entering credentials or payment details on any page, identify the registered domain in the address bar and confirm it is exactly the one you expect, character by character.
Check 2: What HTTPS Does (and Doesn't) Guarantee
The padlock icon in a browser's address bar has one specific meaning: the connection between your browser and that server is encrypted via TLS. It does not mean the server belongs to a legitimate organization. It does not mean the site has been vetted by anyone. It means the traffic is encrypted.
As of 2024, more than 80% of phishing sites used HTTPS. TLS certificates cost nothing to obtain. Let's Encrypt issues them automatically in under 90 seconds with no identity verification required. An attacker can stand up a convincing clone of any login page, serve it over HTTPS, and the padlock appears exactly as it would on the real site.
HTTPS still matters. A login page served over plain HTTP should be treated as a red flag regardless of other indicators. But its presence is not reassurance that the site itself is trustworthy. Treat the padlock as a minimum requirement, not as a safety signal.
Check 3: Scan the URL with VirusTotal
VirusTotal is a free service that submits a URL to more than 90 antivirus and threat-intelligence engines simultaneously and returns a consolidated result. Go to virustotal.com, paste the full URL into the search bar, and click Analyze. Results come back within 10 to 15 seconds.
Reading the result:
- Detection ratio: Shown as a fraction (e.g., 4/90). This is the count of engines that flagged the URL. Even 1 or 2 flags from well-known engines (Google Safe Browsing, Kaspersky, Fortinet, Sophos) is worth taking seriously.
- Community score and comments: Scroll past the engine results. Community members sometimes post recent observations about what a URL does in practice, particularly for sites that are new enough to have escaped full crawler coverage.
- Detection date: A 0/90 result on a URL less than 24 hours old is not a clean bill of health. Phishing campaigns deliberately use fresh domains to outrun database updates. Combine this check with domain age (check 4) when the URL looks new.
VirusTotal requires no account for URL scans and stores no personal data from the query.
Check 4: Look Up When the Domain Was Registered
Most phishing campaigns operate on domains registered within days or hours of the attack going out. A domain age check takes about 30 seconds and reveals this immediately.
Two reliable tools for this:
- ICANN RDAP Lookup: Go to lookup.icann.org, enter just the domain name (not the full URL with https://), and look for "Registration Date" in the results. This is the authoritative registry record.
- DomainTools WHOIS: whois.domaintools.com presents the same data with domain age stated in plain language ("registered 3 days ago") alongside historical registration data when available.
A login page for a bank, health insurer, or retailer sitting on a domain registered three days ago is a hard stop. Legitimate businesses do not launch credential-collection pages on brand-new domains. A site asking for payment on a domain registered the same week a "security alert" email arrived almost certainly did not coincidentally launch that week.
Note that some recently registered domains are legitimate: startups, newly launched products, regional landing pages. Age alone is not disqualifying. Age combined with a login form, a payment request, or unusual urgency is.
Check 5: Google Safe Browsing Transparency Report
Google's Safe Browsing system crawls the web continuously and flags sites that host malware, run phishing pages, or distribute unwanted software. That same data feeds Chrome, Firefox, and Safari's built-in warnings. The Transparency Report exposes it directly.
Go to transparencyreport.google.com/safe-browsing/search, paste the domain or full URL, and click Search. The result is either "No unsafe content found" or a specific threat category with context.
This check complements VirusTotal rather than replacing it. Google's crawler may have indexed a domain that was briefly live months ago and flagged at that time, even if the VirusTotal real-time scan shows it as clean today. Conversely, a domain registered this morning will show as clear on the Transparency Report simply because Google has not had a chance to crawl it. Use both.
Check 6: The Browser Setting Most People Never Enable
Every major browser includes a real-time URL filtering system, but the default configuration in each is weaker than what's available. A one-time change to browser settings catches a large class of threats automatically, before you have the chance to run any manual check.
Chrome: Switch to Enhanced Protection
Open Settings, go to Privacy and security, click Security, and look at the Safe Browsing section. The default is "Standard protection," which checks URLs against a locally cached list that downloads every 30 minutes. "Enhanced protection" checks URLs against Google's servers in real time, catching threats that emerged since the last list download. The documented detection improvement for phishing is substantial for fresh domains.
The tradeoff: full URLs of pages you visit are sent to Google. For anyone already using Chrome, Gmail, and Google Search, this represents a marginal extension of data Google already collects. For users more concerned about this, Firefox with uBlock Origin covers comparable ground without the same data-sharing model.
Edge: Enable Enhanced Security Mode
Microsoft Defender SmartScreen is on by default in Edge, but Enhanced Security Mode is not. Go to Settings, then Privacy, search, and services. Scroll to Security and enable "Enhance your security on the web." This adds stricter sandboxing and code analysis on sites Edge does not recognize. For sites Edge has previously determined are safe, behavior is unchanged.
Firefox
Firefox's built-in phishing and malware protection queries Google Safe Browsing and runs by default with no action needed. For additional coverage, the uBlock Origin extension adds blocking for known malicious domains and scripts at the network layer, which catches threats that Safe Browsing URL lists might miss.
Quick Reference
| Check | Where | Time | Best Catches |
|---|---|---|---|
| 1. Read the domain | Address bar | 5 sec | Subdomain tricks, typosquatting, punycode |
| 2. HTTPS check | Address bar padlock | 2 sec | Baseline filter (absence = red flag) |
| 3. VirusTotal | virustotal.com | 15 sec | Known phishing/malware across 90+ engines |
| 4. Domain age | lookup.icann.org | 30 sec | Recently registered scam domains |
| 5. Safe Browsing report | transparencyreport.google.com | 10 sec | Previously flagged and crawled threats |
| 6. Browser protection | Browser Settings | One-time setup | Real-time protection on every page load |
For most suspicious links, checks 1 through 3 are sufficient. Checks 4 and 5 add confidence when the first three are inconclusive. Check 6 is a one-time change that applies to everything automatically.
If You Already Clicked
Close the tab immediately and do not enter any information on the page. Run a Malwarebytes Free scan to check for drive-by downloads, which some phishing pages attempt to install silently when the page loads.
If you entered a username and password before identifying the page as suspicious, change those credentials from a separate, trusted device right away. Enable two-factor authentication on that account if it is not already active. Phishing pages often redirect visitors to the real site after capturing credentials, which creates a false impression that nothing happened. If any redirect occurred that you did not initiate, treat the session as compromised.
For a deeper look at what malware can do once it lands on a machine and how to remove it, the complete virus and malware guide covers the removal process step by step.
Two Tools That Run These Checks Automatically
The six checks above are free and cover most situations. Two paid tools extend the same protection to every site you visit, not just the ones you remember to check manually.
Malwarebytes Premium
Malwarebytes Premium adds a web protection layer that checks URLs against its threat database before a page loads, blocks downloads from known malicious domains, and alerts you when a site has been flagged. It runs alongside your existing antivirus without conflicts and covers scenarios where you click a link before you have time to run a manual check.
The detection engine updates continuously, which means it catches threats that have emerged since the last update to browser-based safe browsing lists. For users who get phishing links via email or SMS regularly, the automatic blocking removes the need to remember to check every link. Free trial available; annual subscription runs roughly $40 to $45 per year for one device.
YubiKey 5 NFC
Hardware security keys solve the core problem that makes phishing dangerous: even when someone captures your username and password, they cannot log in without the physical key. Unlike TOTP codes (the six-digit codes from apps like Google Authenticator), hardware keys are bound to the specific domain they were registered on. A phishing site at paypa1.com cannot use a code intended for paypal.com, because the key's cryptographic handshake includes the domain name.
The YubiKey 5 NFC works over USB-A and NFC, covering both desktop logins and mobile. Google, Microsoft, GitHub, 1Password, Coinbase, and most major services that support FIDO2 or WebAuthn accept it. It requires no battery and no software. For accounts where a credential theft would cause serious damage (email, banking, password manager), a hardware key turns phishing from a credential risk into a non-event.
For broader antivirus coverage beyond malware removal, the best free antivirus guide covers the options worth running on a Windows PC in 2026. And if pop-up ads are part of what's making you question sites you land on, the guide to stopping pop-up ads covers browser settings and extensions that block them at the source.
Not Sure If Your PC Is Clean?
Run a quick diagnostic with our free PC Tech Helper. Describe what you're seeing and it will walk you through the most likely causes and the right fix order.
Try PC Tech Helper Free →Frequently Asked Questions
Is HTTPS enough to know a website is safe?
No. HTTPS tells you the connection between your browser and the server is encrypted. Over 80% of phishing sites now use HTTPS because TLS certificates are free and require no identity verification. A padlock in the address bar means the connection is encrypted; it says nothing about who operates the server or whether the site is trustworthy.
What should I do if I already clicked a suspicious link?
Close the tab before entering any information. Run a Malwarebytes Free scan to check for drive-by downloads. If you already entered credentials, change them from a separate trusted device immediately and enable two-factor authentication on the affected account. Phishing pages often redirect you to the real site after capturing credentials, creating a false sense that nothing happened. If a redirect occurred that you did not initiate, treat the session as compromised.
Can a website be safe even if the domain was registered recently?
Yes, though a recently registered domain is a meaningful red flag when combined with a login form or payment request. Legitimate companies rarely launch credential pages on brand-new domains. A domain age under 30 days combined with unusual urgency or requests for sensitive information warrants running the full set of checks before proceeding.
Are URL shorteners more dangerous to click?
Shortened URLs hide the destination, making the domain check impossible before clicking. When a shortened URL arrives from an unknown source, expand it first using a service like unshorten.it or checkshorturl.com. With the full URL in hand, you can run the checks in this guide. Some email clients and security filters automatically expand and scan shortened links before they reach your inbox.
Why does the padlock sometimes show a warning triangle instead of a clean lock?
A warning overlay on the padlock means the page loaded over HTTPS but some resources on it (images, scripts, fonts) loaded over plain HTTP. This is called mixed content. It weakens the encryption for those elements and can allow an attacker to tamper with them in transit. Any page handling login credentials or payment should show a clean padlock with no overlays.