Every day, links arrive by SMS, WhatsApp and email, and most people decide whether to tap them on instinct. That instinct is exactly what phishing campaigns are built to exploit. The good news is that the most effective check requires no software at all: reading the full address and locating the real domain. Automated scanners come second, and they exist to confirm a suspicion — not to grant permission. A link that no verifier flags may simply be one nobody has reported yet.
- Read right to left: The domain is the segment immediately before the first slash; everything to its left is a subdomain the owner can fill with anything.
- Shorteners hide the destination: Bitly’s own Link Checker reveals where a short link goes without a click, and Bitly already treats a short link pointing to another short link as suspicious.
- Scanners have blind spots: Google Safe Browsing and VirusTotal are free and well-backed, but a clean result means no one has flagged the address — not that it is safe.
What to look for in the address itself
Start with the domain, the part just before the first slash. Everything to its left is a subdomain, and the domain owner can write whatever they like there. In an address such as tubanco.es.verificacion-cliente.com, the controlling domain is verificacion-cliente.com, not tubanco.es. The trick works because we read left to right and latch onto the first thing we recognise.
Three variants dominate. First, disguised subdomains like the example above. Second, lookalike domains: one letter changed, a hyphen inserted, or a different ending such as .com instead of .es. Third, characters from other alphabets that resemble Latin letters — what Chromium documentation calls a homograph attack, where the Latin “a” and the Cyrillic “а” are nearly identical, letting someone register a domain that reads the same on screen as the original.
Browsers have a built-in defence against the last one. Under Chrome’s internationalised domain name policy, when a name mixes alphabets suspiciously or imitates a heavily visited domain, the browser displays it in punycode — an encoded form beginning with xn--. Chrome also throws up a full warning page when it detects addresses resembling popular sites or ones you visit often. If you see an xn-- where you expected your bank’s name, you already have your answer.
Revealing where a shortened link leads
The reliable route is the shortener’s own checker. Bitly offers a Bitly Link Checker: paste the short link and it displays the destination address beneath it. The tool is also available in its mobile app and requires no login.
Bitly further explains that it blocks suspicious links and shows a warning page instead of the destination. Among the reasons it cites for investigating a link are that someone has reported it, that malicious content was detected, that the address may impersonate another site, or that the destination is hidden behind yet another shortener. That last point is worth keeping: if a short link leading to another short link is already suspicious to Bitly, it should be suspicious to you too.
On mobile there is a shortcut that requires no copying. On iPhone, Apple’s Safari manual notes that holding down a link produces a preview without opening the page; tap outside to dismiss it. On Android, Chrome has long offered a similar long-press preview, though the exact option name varies by version. What you are looking for in that preview is the address, not the appearance. A well-built fake page carries the same logo and colours as the original; what it cannot copy is the domain. The same logic applies to QR codes, which are nothing more than printed links.
Google Safe Browsing and VirusTotal: what they tell you, and what they don’t
These are the two best-supported free checks, and they work differently.
Google Safe Browsing is the system behind Chrome’s red warnings. Google launched it in 2005 and says it protects more than five billion devices every day by showing warnings before users enter dangerous sites or download harmful files. It also operates in Gmail, in Search and on Android. To query it manually, Google offers a site-status tool inside its Transparency Report: paste the address and it tells you whether Safe Browsing currently lists it as dangerous.
VirusTotal is an aggregator. According to its documentation, it examines each item with more than 70 antivirus engines and blocklist services and shows each verdict separately; most distinguish between malware sites, phishing sites and merely suspicious ones. It is free for non-commercial use.
There is fine print almost nobody reads. VirusTotal explains that results are shared with its security partners, that reports are visible to its community, and that the content submitted may be shared with paying customers. In practice, never paste links containing your own data: a password-reset link, a shared-document link, or any address carrying your name, email or an access code. For those cases, the domain check described above is the only one that exposes nothing.
And if both tools say the link is clean? That means nobody has flagged it, not that it is safe. Per its documentation, VirusTotal analyses addresses by querying the databases of collaborating services, and a link appears dangerous as soon as one of them adds it to a blocklist. A domain registered yesterday may not yet appear anywhere, and that gap is precisely what a phishing campaign can exploit. A clean result lowers suspicion; it does not erase it if the message accompanying the link was already dubious.
The order matters more than the tool. Start with context: if you were not expecting the message and it demands fast action, the safest verification is not to open the link at all and instead reach the service yourself by typing the address or using the official app. Then examine the address. Only last, use Safe Browsing or VirusTotal as a second opinion.
Verifiers carry a dangerous psychological effect: they turn a doubt into a green light. If a bank, a parcel company or a public body genuinely needs you, the procedure will still be waiting when you arrive through the front door. A link that only works if you click right now is, almost always, the problem itself.