A familiar brand name somewhere in a link does not mean the link belongs to that brand. Identify the hostname and compare it with an address you already trust. PhishLens helps unpack URL signals without visiting the destination.
Read the hostname, not the familiar word
In https://accounts.example.com.attacker.test/login, accounts.example.com is a subdomain of attacker.test. In https://attacker.test/example.com, the familiar name is only in the path. These illustrative addresses show why searching the entire URL for a brand name can be misleading.
In https://example.com@attacker.test/, the text before @ is user information; attacker.test is the hostname. Real domains can have multi-part public suffixes, so taking the final two words is not a reliable general rule.
Treat patterns as clues
- Unexpected user information, unusual encoding or a raw IP address warrants review, but does not independently prove phishing.
- HTTPS describes the connection protocol; it does not establish a trustworthy operator.
- A long URL may contain ordinary tracking or application state. Length alone is not a verdict.
- Short links hide destination context. PhishLens does not follow redirects to reveal the final page.
Use PhishLens for a local first look
- Copy the address without opening the destination. Do not share private reset tokens or signed URLs publicly.
- Paste it into PhishLens and review the hostname and individual signals.
- Choose optional external checks only after reading what information they share.
- Verify an unexpected request through a known channel, or open the service using a trusted bookmark.
Keep unknowns visible
Local analysis inspects URL structure. Optional intelligence and DNS checks add domain context, but do not inspect page content, validate ownership or establish the reputation of every full URL. A provider error means the check is unavailable. An ordinary-looking address can still lead to a malicious page.
For an unexpected payment or login request, independently verify the request before entering information. Few warnings do not make a message trustworthy.