Plain-English explanations of the signals CheckLink uses to review suspicious links.
Whether the final destination uses HTTPS.
HTTPS protects the connection, but it does not prove that the website is legitimate.
Treat missing HTTPS as a caution signal. Even with HTTPS, verify the domain before entering credentials or payment details.
How many times a URL sends the browser somewhere else.
Redirects are common, but long chains can hide the final destination or add tracking layers.
Check the final domain and be more careful when a link jumps through several sites.
The URL ends on a different domain from the one first entered.
A different final domain can be normal for campaigns, but it can also hide impersonation or short-link abuse.
Compare the final domain with the sender, brand, and action requested before you trust it.
The destination uses an IP address instead of a readable domain.
Raw IP hosts can appear in temporary infrastructure and phishing pages.
Avoid entering credentials or payment details unless you can verify why an IP address is expected.
The hostname contains encoded characters such as xn--.
Punycode is legitimate technology, but it can hide lookalike characters in domains.
Verify the destination through the official website when the encoded domain appears in a login, payment, or account link.
The domain resembles a known brand with small changes.
Lookalike domains can trick users into trusting fake login, support, or payment pages.
Open the service directly from the official site or app instead of trusting the message link.
The hostname has many nested labels before the main domain.
Long subdomain chains can make a fake destination look like it belongs to a trusted brand.
Read the base domain, not just the first words in the URL.
The final base domain differs from the input base domain.
A mismatch can indicate that a link is hiding its real destination.
Check whether the final base domain matches the brand or sender you expected.
Unusual URL features such as dense separators, digits, or complex hostnames.
Structure alone rarely proves danger, but it can add context when combined with other signals.
Use the structure as a reason to slow down, then inspect the final domain and request manual review if the link affects work, money, or accounts.
Email senders are checked for domain, free-provider, disposable, number, and separator patterns.
Sender patterns can reveal throwaway accounts or possible impersonation, especially in payment or login requests.
Verify the sender through a separate channel before replying, paying, or clicking.
Some email/domain checks add caution for TLDs that often appear in abuse patterns.
A TLD is not proof of risk, but it can be a weak signal when combined with impersonation, urgency, or redirects.
Do not judge by TLD alone. Combine it with domain, sender, and page context.
Signals are clues. Manual review can help when redirects, business context, login pages, or payment links make the decision higher stakes.