URL Analysis: How to Check a Suspicious Link Safely

URL analysis is how you find out what a link actually is before anyone clicks it: where it really leads, who registered it, what the page does when it loads, and whether the wider world already knows it is malicious. A suspicious link can be checked safely in about two minutes using free tools, without ever opening it in your own browser. This guide walks through the process the way an analyst runs it, from reading the URL itself to sandboxed detonation, and covers what to do when the click already happened.

Step 1: read the URL before you test it

Most malicious links give themselves away to a careful reader. Work right to left through the hostname, because the only part that matters is the registered domain immediately before the top-level domain:

• Lookalike domains: micros0ft-support.com, paypa1.com, yourbank-secure.net. The brand name appearing anywhere in the URL means nothing; only the registered domain counts.
• Subdomain tricks: paypal.com.account-verify.info is not PayPal; the real domain is account-verify.info. Attackers stack trusted names on the left because most people read left to right.
• Homograph characters: Cyrillic and other lookalike characters can make a hostname visually identical to the real one. Copy the link into a plain-text editor; disguised characters often surface as punycode (xn--).
• Shorteners and redirects: bit.ly and friends hide the destination entirely. Expand them without visiting (unshorten services, or curl with redirects disabled) before judging anything.
• Credential-bait structure: URLs carrying login, verify, suspended, invoice, or an urgent deadline in the path are playing a psychological game, not a technical one.

Step 2: check reputation without visiting

• VirusTotal checks a URL against dozens of security engines at once and shows you the redirect chain and related artifacts. The universal first stop.
• Google Safe Browsing's site status tells you whether Google currently flags the page, the same verdict Chrome enforces.
• urlscan.io (see step 3) shows whether others have already scanned the same link and what it did.
• WHOIS and certificate data: a domain registered nine days ago claiming to be your bank is its own verdict. Note that the padlock proves encryption, not honesty; most phishing sites have perfectly valid certificates.

Step 3: detonate it somewhere disposable

When you need to see the page, never use your own browser. urlscan.io visits the URL from its own infrastructure and hands back a screenshot, the full request chain, the scripts it loaded, and the domains it talked to, which answers most questions. For active malware investigation, a sandbox service or an isolated analysis VM is the professional path. The rule is absolute: if the point is to see what a hostile page does, it must not do it on a machine you care about, logged into accounts you care about.

Step 4: judge what you found

Malicious verdicts are easy. The ambiguous middle is where judgment lives: a young domain with no reputation, a login page that looks right but sits on the wrong registered domain, a redirect chain that ends somewhere unrelated to the link text. Treat "not yet flagged" as exactly that; brand-new phishing pages routinely enjoy a clean-reputation head start measured in hours. When the stakes involve credentials or payments, verify through a channel you already trust (the app, the bookmarked site, a known phone number) rather than through anything the message supplied.

If the click already happened

1. Disconnect nothing dramatically; start by changing the password for any account whose credentials were entered, from a different, known-clean device, and revoke active sessions.
2. Enable or verify MFA on the affected account, and watch for MFA-fatigue prompts you did not initiate.
3. Report it: to your security team if you have one, and to the impersonated brand. Early reports are how takedowns start.
4. If the machine ran anything (an attachment, an installer, a browser extension), treat it as potentially compromised and get it looked at rather than hoping. Our incident response steps guide covers what a real response looks like from here.

For organizations: the layer above manual checking

Manual URL analysis scales to the links people think to question. The dangerous ones are the links nobody questions, which is why organizational defenses matter more than analyst tricks:

• Email security that rewrites and detonates links before delivery, so the check happens on every message rather than the suspicious-looking ones
• DNS filtering that refuses to resolve known-bad and newly registered domains fleet-wide
• Detection over identity and endpoints, because some phishing will always get through, and the response window is what decides the damage; that is the ground SubRosa's Managed SOC covers
• People who have seen the tricks: security awareness training builds the reading-the-URL reflex this guide describes, and social engineering testing measures honestly whether it stuck