Is this link safe? How to check a link before you click
Updated September 30, 2026 · by the IsLegitOrNot team
Phishing links are the most common way people end up on scam websites. They arrive by text message, email, social media or ads, and lead to pages that copy real brands to steal passwords or card details. You can check most links in under a minute.
1. Read the real address, not the text
The words you see in a message can say anything. On a computer, hover over the link to see the real address. On a phone, press and hold the link to preview it without opening it.
2. Find the actual domain name
The part that matters is the name just before the first single slash. In paypal.com.account-verify.xyz/login, the real domain is account-verify.xyz, not PayPal. Scammers put the brand name at the start to fool you.
3. Look for lookalike spelling
Watch for swapped letters and extra words: arnazon instead of amazon, netfIix with a capital i, or brand-support-help. Unusual endings such as .top, .xyz or .icu on a well-known brand are a strong warning.
4. Check the link with a link checker
Paste the website address into our website checker. It shows how old the domain is, whether it appears in public phishing feeds, and whether it has a valid certificate. A brand-new domain that copies a famous brand is almost always phishing.
5. When in doubt, go direct
Instead of clicking, open the app or type the official address yourself. Real companies rarely ask you to "verify your account" or pay a small delivery fee through a link in a text message.
Already clicked? Do this now
- If you entered a password, change it on the real site and anywhere else you use it.
- If you entered card details, call your bank to block the card.
- Turn on two-factor authentication for email and banking.
- Report the link: see where to report a scam website.
Opening a link alone rarely infects a modern, updated phone or computer, but downloading files from it can. Never install apps or files a message asks you to download.