What Is a Phishing Link? How to Spot and Avoid Them

Phishing is the most common attack vector on the internet. According to the Anti-Phishing Working Group, over 1.3 million unique phishing sites are detected every quarter — and the number keeps climbing. Understanding how phishing links are constructed is the first step toward not falling for one.

What Is a Phishing Link?

A phishing link is a URL crafted to deceive. It looks enough like a legitimate address that you click it, land on a fake page, and either hand over credentials or trigger a malware download. The deception can happen at the domain level, the path level, or both.

Legitimate:  https://www.paypal.com/signin
Phishing:    https://www.paypal.com.account-verify.net/signin
             https://paypa1.com/signin
             https://secure-paypal.com/signin

All three phishing examples look plausible at a glance. None of them are PayPal.

Anatomy of a Phishing URL

Understanding URL structure lets you read any link critically.

https://login.paypal.com.account-verify.net/secure/signin?token=abc123
  │       │       │       └─ actual domain: account-verify.net
  │       │       └─ looks like paypal.com but is just a subdomain
  │       └─ subdomain that looks like the brand
  └─ HTTPS — provides encryption, NOT legitimacy

The registered domain is always the part immediately before the first / after the protocol. Everything before that is subdomains, which the attacker fully controls.

7 Techniques Attackers Use

1. Lookalike Domains (Typosquatting)

Registering domains with small spelling errors or character substitutions:

2. Subdomain Spoofing

The actual domain is attacker-controlled, but a legitimate brand name appears as a subdomain:

paypal.com.secure-login.xyz    ← domain is secure-login.xyz
amazon.com.account.help.ru     ← domain is help.ru

3. Homoglyph Attacks

Using characters from other alphabets that look identical to Latin letters:

pаypal.com  ← contains Cyrillic 'а' (U+0430), not Latin 'a' (U+0061)
gοοgle.com  ← contains Greek omicron 'ο', not Latin 'o'

Your browser may or may not display these differently. IDN (Internationalized Domain Name) domains make this especially tricky.

4. URL Shorteners and Redirects

bit.ly/3xK9mPq        → hides final destination
t.ly/phishing         → trusted brand, unknown target
google.com/url?q=...  → open redirects on legitimate domains

Open redirects on legitimate domains are particularly dangerous — the domain itself is real, and the URL passes many filters.

5. HTTPS with Fake Certificates

A valid TLS certificate only proves the server owns the domain. It says nothing about whether the site is legitimate. Free CAs like Let’s Encrypt issue certificates automatically without human review of site content.

6. Path and Parameter Confusion

https://evil.com/signin/paypal.com/account
https://evil.com/?redirect=https://paypal.com

Some users look only at the path, not the domain.

7. URL Encoding and Obfuscation

https://evil.com/%70%61%79%70%61%6C     ← "paypal" URL-encoded
https://evil.com/signin#paypal.com      ← hash fragment, ignored by server

How to Spot a Phishing Link: Quick Reference

How Phishing Links Reach You

Email remains the primary vector — 96% of phishing attacks arrive via email (Verizon DBIR). Attackers spoof sender addresses using domains without DMARC policies, or use legitimate email infrastructure via compromised accounts.

SMS/Smishing: Text messages with shortened links. Carriers provide less filtering than email servers.

Search Ads: Attackers buy ads for brand keywords. The URL in the ad may be correct, but the landing page redirects.

QR Codes: QR codes bypass URL inspection entirely — users can’t read them before scanning.

Social Media: Direct messages from compromised accounts. Because you know the sender, trust is higher.

Domain-Level Phishing Protection

If you own a domain, you can reduce the chance of phishing from your brand:

; Email authentication — prevent header spoofing
your.domain.  TXT  "v=spf1 include:_spf.google.com ~all"
_dmarc.your.domain.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@your.domain"

; DKIM — add signing to your email provider config

A p=reject DMARC policy tells receiving mail servers to drop email that fails authentication — directly blocking domain spoofing in email.

Register common typosquats of your own domain and redirect them to your real site. Services like DomainScan can monitor whether your domain appears on phishing blacklists.

What Happens After You Click

1. Credential harvesting: Fake login page captures username + password, forwards to attacker, redirects victim to real site.
2. Drive-by download: Exploit kit probes browser/plugin versions, delivers payload for unpatched vulnerabilities.
3. Malware dropper: User is prompted to download “invoice.pdf.exe” or “document.docm” with malicious macro.
4. Session hijacking: JavaScript steals existing session cookies from the browser.

Most phishing pages use pre-built phishing kits — packaged templates that clone a brand’s login page, complete with PHP scripts that email stolen credentials to the attacker.

Browser and Platform Protections

Modern defenses that catch phishing before you do:

• Google Safe Browsing: Blacklist checked by Chrome, Firefox, Safari before page load
• Microsoft Defender SmartScreen: Edge and Windows integration
• Email provider filtering: Gmail, Outlook classify based on sending reputation + content
• Password manager autofill: Won’t autofill on a domain that doesn’t match — a reliable tell

None of these are 100% effective for zero-day phishing pages. A page registered today has no reputation.

Summary

Phishing links succeed because they exploit trust in domain names that users haven’t learned to read carefully. The registered domain — the part just before the first / after the protocol — is the only part the attacker can’t fake without controlling infrastructure. Train yourself to check that first, before anything else in the URL.