learn / security for everyone / f2 · 1 of 1 · 5 min
Every link tells you where it really goes — if you know which part to read.
## Where does this link really go?
A URL has parts, and attackers hide in the ones people don't read carefully:
https://login.paypal.com.account-check.ru:443/signin?next=/home
└─┬─┘ └───────┬───────┘└───────┬──────┘└─┬┘└──┬──┘└────┬────┘
scheme subdomains registrable port path query
domainThe registrable domain (account-check.ru) decides who controls the site. Everything to its left is a subdomain the owner can set to anything — including paypal.com. Read the hostname right-to-left, starting from the first single /.
## The tricks scammers use
- Brand as a subdomain —
paypal.com.account-check.ru - Lookalike spelling —
paypa1.com,rnicrosoft.com(r + n looks like m) - Extra words —
paypal-support-team.comis not paypal.com - The @ trick — in
https://paypal.com@evil.example/, everything before@is ignored - Shortened links —
bit.ly/…hides the destination entirely
How AI changed this: bad grammar used to be the giveaway. AI now writes perfect, personalized scam emails in any language — so the link and the sender's address matter more than ever.
Which of these links actually goes to PayPal?
## Spot it in the wild
Tap everything suspicious in this email.
0 tapped · 4 red flags hidden in here
## When you're not sure
Don't trust the link text — check the real destination. Hover on desktop, or long-press on a phone, to preview where a link goes. When in doubt, navigate there yourself.
You get a text saying your bank account is frozen, with a link. Put these steps in the right order.
- 1.Look at the real domain in the link
- 2.Don't tap the link
- 3.Open your bank's app or type its address yourself
- 4.Report the message, then delete it
## Write it down
If you report a suspicious message, jot down when you got it, who it claimed to be from, and the real domain in the link. That three-line note is exactly what a help desk — or your bank — will ask for. It's also your first piece of incident documentation.