Direct answer
Do not open a suspicious link to see whether it is real. Copy it without visiting the destination, examine the hostname and message context, and contact the organization through a known address or app. A URL checker can highlight clues but cannot guarantee safety.
Pause and preserve the context
Unexpected requests to sign in, pay, or act urgently deserve independent verification, even if they appear to come from a familiar sender. Do not reply or use the message's phone number. Contact the organization using a number or website you found independently, or open its app yourself.
- Do not open attachments or click an unsubscribe link in a suspicious message.
- Use your workplace's reporting process if the message arrived on a work account.
- Keep a copy for the security team only if that is consistent with your organization's reporting instructions.
Reference: CISA: Avoid Phishing Scams with Three Simple Tips.
Examine the actual hostname
A link's displayed text can differ from its destination. Copy the address without opening it and inspect the hostname carefully. For example, in https://accounts.example.test.attacker.test/login, the hostname is accounts.example.test.attacker.test; the earlier example.test text does not make it an example.test address. Those names are illustrative, not real services.
- Be alert to unfamiliar domains, unexpected subdomains, unusual spelling, and shortened URLs.
- A URL containing an @ character can place misleading text before the actual hostname.
- HTTPS encrypts a connection; it does not establish that the site or request is trustworthy.
Use a local checker as a clue
BugSnaps PhishLens examines URL structure and text in the browser and does not visit the destination. Its highlighted patterns are a starting point: familiar-looking addresses can still be malicious, while an unusual address can be legitimate. Optional domain intelligence and DNS checks are initiated separately and may be incomplete or unavailable; the tool does not follow redirects or establish domain ownership.
- Avoid pasting sensitive links containing authentication tokens into tools you do not trust.
- Treat an unflagged result as inconclusive, not a safe-to-open verdict.
- Do not try to inspect the destination yourself when your organization's procedure calls for security staff.
If you already interacted
If you entered a password or payment information, contact the affected service or financial institution through a trusted channel promptly. Change the exposed password and any reused passwords, enable multi-factor authentication where available, and follow your organization's incident process. The right response depends on what was disclosed or downloaded.
Reference: FTC: What To Do if You Were Scammed.
Assessment limits
Visual URL checks and automated patterns cannot prove ownership, reveal what a destination will do, or establish the safety of a redirect. Scammers can use legitimate hosting and convincing language; independent verification remains necessary.
Frequently asked questions
Does HTTPS mean a link is safe?
No. HTTPS protects the connection to the server you reach; it does not establish whether that server is the intended organization or whether its request is legitimate.
Does PhishLens visit a suspicious site?
The BugSnaps page describes a local browser check of URL structure and text; it says the tool does not visit the destination or follow redirects. Optional external domain checks run only when selected and do not establish complete URL safety.
Is a short link automatically malicious?
No. A short link hides the final destination and may be legitimate, but it makes independent verification more important. Avoid opening an unexpected link to find out where it goes.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.