How to Spot a Fake Website: 10 Red Flags in a URL

How to Spot a Fake Website: 10 Red Flags in a URL

Most online scams start with a single link. A text message, an email, an ad, a search result — one tap and you land on a page that looks exactly like your bank, your delivery service, or your favorite store. The page is fake. The login box is a trap. And by the time you notice, your password (or your money) is already gone.

The good news: fake websites almost always leave clues in the address bar. Once you know what to look for, you can catch most of them in a few seconds — before you type anything. Here are the ten red flags that give a fake website away.

1. Look-alike or misspelled domain names

Scammers register domains that look right at a glance: paypa1.com (a number "1" instead of the letter "l"), arnazon.com ("rn" pretending to be "m"), faceb00k.com. Slow down and read the domain letter by letter. If anything is swapped, doubled, or misspelled, leave.

2. The real domain isn't where you think it is

This is the trick that fools the most people. Look at:

paypal.com.secure-login.xyz

Your eye sees "paypal.com" and relaxes. But the real domain is always the part right before the top-level ending — here that's secure-login.xyz, not PayPal. Read a web address right to left: find the ".com/.xyz/.net" ending, and the word immediately before it is the true owner of the site.

3. An "@" symbol in the link

Everything before an @ in a URL is ignored by your browser. So a link like https://paypal.com@evil-site.ru/login does not go to PayPal — it goes to evil-site.ru. If you see an @ in the middle of a web address, treat it as hostile.

4. A padlock does NOT mean "safe"

You were probably told to "look for the padlock." That advice is outdated. The padlock (HTTPS) only means the connection is encrypted — it says nothing about who is on the other end. Today the large majority of phishing sites have a padlock too, because certificates are free. A missing padlock is a bad sign; a present padlock is not a good one.

5. Strange characters in a familiar name (homograph attack)

Some letters in other alphabets look identical to English ones. An attacker can register аpple.com using a Cyrillic "а" that your eye reads as a normal "a." In the address bar these sometimes show up as a domain starting with xn--. If a well-known brand's address suddenly contains odd characters or an xn-- prefix, it's a fake.

6. Odd endings and free hosting posing as a brand

Big companies use their own domains. Be suspicious when a "bank" or "courier" page lives on a random free subdomain (your-bank.weebly.com, dhl-tracking.rf.gd) or on a cheap, throwaway ending like .zip, .top, or .click. Legitimate brands rarely run their login pages on hosting like that.

7. The link text and the real destination don't match

On a computer, hover your mouse over a link (don't click) and look at the address your browser shows at the bottom of the screen. On a phone, press and hold the link to preview it. If the visible text says one thing but the real destination is somewhere else entirely, that mismatch is the scam.

8. Shortened links that hide where they go

Short links (bit.ly, tinyurl, and similar) are convenient — and perfect for hiding a destination. If a stranger, an ad, or an urgent message sends you a shortened link, don't click blind. Expand it first with a link-preview/expander service, or simply go to the site yourself.

9. A raw IP address instead of a name

Real services use names, not numbers. A link like http://185.203.44.17/verify pointing at your "bank" is almost always malicious. Numbers in place of a domain name are a strong warning sign.

10. Urgency, threats, and pages that just want your password

"Your account will be suspended in 24 hours." "Confirm now or lose access." Fake sites manufacture panic so you act before you think. Combine that pressure with a page whose only purpose is to collect your login or card details, and you're looking at phishing. Real companies don't threaten you into a random link.

The 10-second safe-check habit

You don't need to memorize all ten. Build one habit instead:

  • Don't click first. Hover (desktop) or long-press (mobile) to reveal the real address.
  • Read the domain right to left and confirm the true owner — the word just before .com/.net/.xyz.
  • Never enter a password or card number on a page you reached from a link or message.
  • Go there yourself instead: open the official app, or type the address / use your own bookmark.
  • Verify by a second channel if in doubt — call the number on the back of your card, not the one in the message.
Coming soon — free link checker. Paste any suspicious link and we'll flag the red flags above automatically. Bookmark this page and check back.

Being careful vs. being trained

The checks above are consumer-level self-defense — enough to keep you and your family safe from the everyday scams. But recognizing a fake URL is the very first thing security professionals learn on the way to spotting phishing, malware delivery, and full-blown intrusions.

Curious about doing this for a living?

If defending systems (not just yourself) sounds like your kind of thing, a foundation like CompTIA Security+ is where most people start. See the exam-prep paths on CertInstructor →

Written by the team at Security365 / CertInstructor — 20+ years training cybersecurity professionals, holders of the full CompTIA security certification stack, and recipients of the EC-Council Instructor Circle of Excellence Award (two years running).

Comments

Post a Comment

Popular posts from this blog

CompTIA Security+ PBQs: What Performance-Based Questions Are and How to Prepare

CompTIA Security+ PBQs: What Performance-Based Questions Are and How to Prepare Ask anyone who failed Security+ by a few points what got them, and the answer is usually the same: the performance-based questions. PBQs are the part of SY0-701 that catches readers off guard — and they're also the most beatable, once you know how they work and prepare the right way. What a PBQ actually is A performance-based question isn't multiple choice. It's an interactive simulation that drops you into a scenario and makes you do something: configure a firewall rule, match attacks to defenses, read a log and identify the incident, set permissions, or complete a task in a simulated interface. Instead of asking whether you know a concept, it checks whether you can apply it. Why they decide pass/fail They're weighted heavily. A single PBQ can be worth several multiple-choice questions. They come early. PBQs usually appear in the first few questions — right when nerves a...
Read more

How to Study for CompTIA Security+ (SY0-701): A Realistic Plan

How to Study for CompTIA Security+ (SY0-701): A Realistic Plan Security+ is very passable — but not by reading alone the night before. The candidates who clear it on the first try almost always follow the same three-phase rhythm: learn the material, practice it hands-on, then confirm they're ready before booking. Here's how to run that plan for the current SY0-701 exam without wasting money or time. Know what you're walking into SY0-701 is up to 90 questions in 90 minutes, and you need a scaled score of 750 out of 900 to pass. The questions come from five weighted domains, with Security Operations the largest. Crucially, a handful are performance-based questions (PBQs) — hands-on simulations that usually appear early and carry real weight. That single fact shapes the whole study plan: you can't pass on memorization. Phase 1 — Learn the material Start by working through every objective in order, building the vocabulary and mental model. This is what a self-p...
Read more

Fake Bank & Shipping Websites: How the Scam Works

Fake Bank & Shipping Websites: How the Scam Works Two kinds of brands get impersonated more than any other: banks and delivery companies . Almost everyone has an account with one and a parcel from the other, so the messages feel plausible — and that's exactly why they work. Here's how each scam is built, step by step, and how to shut it down before it costs you anything. The fake bank scam It usually starts with a message that manufactures fear: "Suspicious login detected," "Your account is locked," "Verify your identity to avoid suspension." The message carries a link to a page that is a near-perfect copy of your bank's login screen. Here's the machinery behind it: The bait: an urgent SMS or email with a link. The domain is a look-alike — something like yourbank-secure.com or yourbank.verify-account.xyz , not the bank's real address. The trap: you type your username and password into the fake page. It's capt...
Read more