What is URL phishing and how do you spot a malicious link?

URL phishing sends a link that looks trustworthy but leads to a site controlled by an attacker, usually to steal a password or deliver malware. The giveaway is almost always in the hostname, the part between the scheme and the first single slash, not in the words that follow.

How is a URL built?

RFC 3986 defines the generic syntax: a scheme such as https, an authority that holds the host and optionally a user information part and a port, then a path, query and fragment. Reading a link correctly means finding the host.

Consider the constructed link https://login.example.com.account-check.invalid/reset. The real host is the last labels before the first slash, here account-check.invalid. The words login.example.com are just subdomain labels on that host. People read the familiar name at the left and stop.

The user information part adds another trick. In https://example.com@evil.invalid/ the text before the at sign is a credential field, and the true host is evil.invalid. Many clients now warn about or remove this form, but not all.

What tricks do attackers use?

Lookalike domains. Swapping or dropping a character, or using a plausible extra word such as secure or support in the name.

Subdomain stacking. Putting a trusted brand in a subdomain label, as in the example above.

Internationalized lookalikes. Some scripts contain characters that look like Latin letters. Browsers apply display rules to reduce this, but it is a reason not to rely on the eye alone.

Link shorteners and redirects. A short link hides the destination, and an open redirect on a trusted site can bounce a victim to a bad one.

Trusted hosting. The page sits on a legitimate file sharing or form service, so the domain itself is not suspicious.

QR codes and text messages. The same links arrive by SMS, which CISA calls smishing, or by voice prompts. The channel changes, the logic does not.

CISA's phishing guidance lists common signs: a sender address that imitates a real business by altering a few characters, generic greetings, spoofed hyperlinks that do not match the visible text when you hover, and pressure to act quickly.

Does a padlock mean the site is safe?

No. The padlock shows the connection is encrypted and that the certificate matches the domain you are visiting. An attacker can get a certificate for their own lookalike domain. It tells you the traffic is private, not that the owner is honest.

What does an attacker do after the click?

MITRE ATT&CK catalogs this as Phishing: Spearphishing Link, technique T1566.002, where adversaries send emails with a malicious link to gain access to victim systems. The link may lead to a fake login page that captures credentials or to a download of malicious code.

Constructed example: the shared document

An employee gets a message saying a colleague shared a document, with a button. The link goes through a legitimate file service to a page asking them to sign in again. The domain in the address bar is not their company login. Someone who checks the host, or simply opens the company portal from a bookmark, avoids it.

How to check or apply this

1. Hover over a link and read the host, the part before the first single slash after https://, before you click.
2. When a message asks for a login, go to the site through a bookmark or by typing the address instead.
3. Use multi factor authentication, ideally with phishing resistant methods, so a stolen password alone is not enough.
4. Configure email filtering and web filtering to rewrite or block known bad domains, and report suspicious messages through a single easy channel.
5. For developers, never build redirects from user supplied URLs without an allow list, since open redirects help attackers.

Quick check

Sources

• RFC 3986, Uniform Resource Identifier: Generic Syntax
• CISA, Avoiding Social Engineering and Phishing Attacks
• MITRE ATT&CK T1566.002, Spearphishing Link

Last reviewed: 18 October 2026.