Is This Link Safe? 7 Warning Signs Hiding in a Short URL
A text arrives. "Your parcel is held. Confirm your address." Under it sits a short link and nothing else. Is this link safe?
You cannot judge a short link by the link. Judge the address it opens and the message it came in. In that address, the real site is the name just before the first single slash. Read it from the right, and ignore anything before an @.
Is it dangerous to just open it?
Almost never, if your phone or computer is up to date.
Your browser runs every page in a locked box. Chrome's security team rates full control of that box as High risk, not Critical. Critical is kept for chains of bugs that break out of it. Taking over the tab is not taking over your device.
Those breakouts are rare: Google's threat intelligence team counted 90 unknown flaws used in real attacks during 2025, and browsers were under 10% of them. Google adds that its count "may not reflect all zero-day exploitation".
The risk is not the page loading. It is what the page talks you into doing next.
Typing a password. Entering a card. Opening a file you downloaded. One thing does happen every time: the site learns that your number or email is live.
The trap that beats the usual advice
Some scam pages never ask for a password. They ask you to approve an app on a real Google or Microsoft screen, where the address genuinely is google.com. Checking the address tells you nothing.
Microsoft calls this consent phishing: you hand an outside app standing permission to your account. Microsoft also says that resetting a password or adding multi-factor authentication "aren't effective against this type of attack".
So read what an app is asking for before you tap Allow. Give it more care than a login box, not less.
Is this link safe? The 7 warning signs
Three addresses, one destination.
| The address in the message | Where it really goes |
|---|---|
paypal.com.secure-login.xyz/login |
secure-login.xyz |
paypal.com@secure-login.xyz/verify |
secure-login.xyz |
secure-login.xyz/paypal.com/login |
secure-login.xyz |
1. The name reads wrong from right to left
The name just before the first single slash is the site. Read the end of it, not the start.
So paypal.com.secure-login.xyz is not PayPal. The site is secure-login.xyz, and everything to the left of that is a label its owner picked. They can pick your bank's name.
How much of the end counts? Usually the last two parts, but that is a rule of thumb rather than a law. example.co.uk is a real site and co.uk is not. Browsers tell them apart using the Public Suffix List.
2. There is an @ in the address
Most articles say browsers fixed this one. Chrome has not.
Everything before the @ is a username, and the site is whatever comes after it. Mozilla's web documentation calls this a semantic URL attack.
We clicked https://www.google.com@example.org/ in Chrome in September 2026. It opened example.org, with no warning and nothing loaded from Google.
If you see an @, the real site is whatever follows the last one.
3. Letters that are almost right
paypa1.com with a digit one. rnicrosoft.com with r-n in place of m. These need no cleverness, only your hurry.
A sharper version uses letters from another alphabet that look identical. Chrome watches for that and shows the raw form instead, which starts with xn--. That is a genuine red flag in an address bar.
That guard is a set of rules, not a promise. It misses plain misspellings.
4. A padlock treated as proof
A padlock means the connection is encrypted. It says nothing about who owns the site.
Google removed it from Chrome in September 2023, in version 117. Its own explanation is blunt: "nearly all phishing sites use HTTPS, and therefore also display the lock icon". Only 11% of people in Chrome's study understood what the icon meant.
Safari and Firefox still show a lock-style mark. Read it as "encrypted", nothing more.
5. Wording that rushes you
The UK's National Cyber Security Centre lists the tells in a scam message: authority, urgency, emotion, scarcity, and news events. Its summary is short. "They aim to pressure you into acting without thinking."
This is the one classic piece of advice that official sources still back in full. Their fix costs nothing. If a message worries you, contact the company yourself, using the details on their website.
6. A shortener you have never heard of
Singapore's Cyber Security Agency puts it plainly: shortening can mask a phishing site, "hence it is difficult to ascertain the legitimacy of the shortened link".
And shorteners do not check that destination for you. Bitly says it uses in-house tools and outside abuse vendors, and names no threat list in its public policies. TinyURL's terms say you visit a linked site "entirely at your own risk". Takedowns come after a report, so a link made an hour ago has been through none of it.
You will also read that some share of phishing uses short links. No government body publishes that number. Every figure in circulation is vendor marketing. If you want the destination first, expanding a bit.ly link takes one step.
7. A link you were not expecting
This one outranks the other six. Banks do not text you a login link, and delivery firms do not need your card. The pattern is a message you did not ask for, about money or an account.
It holds for familiar senders too: stolen accounts send links to everyone in them. If a friend sends a bare link with no message, ask them about it somewhere else.
What to do if you already tapped it
Close the tab. Then answer one question honestly: did you type anything, approve anything, or open a file? If not, you are almost certainly fine.
If you typed a password, change it on the real site and anywhere you reused it. If you approved an app, remove it in your Google or Microsoft account settings. If you gave card details, call your bank on the number printed on the card.
One quiet tell: a password manager fills a login form by matching the domain. If it stays silent on a familiar page, the domain is wrong.
Questions people ask
Should I run the link through a virus scanner?
Safe for your device, yes: the scanner visits the page and you do not. Two catches. VirusTotal's terms say in capitals not to send anything you would not share publicly, and urlscan.io scans are public by default. And do not over-read a hit: three of about ninety engines flagged our harmless test link in September 2026.
Does a clean scan mean the link is safe?
No. Scanners report what is already known, and a page built this morning has no history. Pasting a short link into Google's Safe Browsing checker returns "no available data", because that tool judges whole sites, not one short URL.
Can I preview a short link without opening it?
Often, yes. Free tools follow the redirect and show you the destination. Our guide on checking where a short link goes covers the ones that still work. An old link that does nothing is usually link rot, not fraud.
Does long-pressing on my phone show where it goes?
Only partly. A long press shows the link's own address, which for a short link is still the short link. It does not follow the redirect, so it tells you nothing about the destination.
Check a link before you tap it
If you would rather see the destination than guess, clik.so's free link checker follows a short link and shows the address it opens. No account needed.
The habit matters more than the tool. Read the name right to left, ignore anything before an @, and be slowest with the messages that rush you.