Anatomy of a scam link
A fake link is built to be skimmed, not read. Here's one pulled apart into its six parts, so you know exactly where to look next time.
An example built for this guide. It isn't a real website.
The six parts, labelled
- 1
No padlock
http://The connection isn't encrypted. Real sign-in pages always start with https://.
- 2
The decoy
paypal.com.secure-login.A brand name placed on the left as a subdomain. The scammer can write anything here, so it proves nothing.
- 3
The real owner
verify-accountThe name just before the ending is who actually owns the site. Here it's verify-account, not PayPal.
- 4
A cheap ending
.xyzDomain endings like .xyz, .top and .click cost very little and turn up often in scam reports.
- 5
Pressure words
/signin/updateWords like sign-in, update, verify and suspended make the page feel official and urgent.
- 6
The getaway
?next=https%3A%2F%2Fpaypal.comAfter you type your details, this sends you on to the real PayPal so you don't notice anything happened.
The one rule to remember: find the last two words before the first single slash, here verify-account.xyz. That's who owns the site. Everything to its left is decoration.
Two more tricks to know
The @ sign
In https://paypal.com@203.0.113.42/, everything before the @ is ignored. The link really goes to the number after it.
Look-alike spelling
Swapped characters such as paypa1 (a digit one instead of an L) or rn in place of m are easy to miss. Read the real domain letter by letter.
See how SafeToHop scores the example →
Share this infographic
You're welcome to use this infographic on your website, newsletter or training materials, as long as you credit SafeToHop with a link. Open the full-size image (1080 × 1350).
Not sure about a link?
Paste it into SafeToHop. We read the address without opening it.