Guides

How to check a link before you open it

You can catch many bad links in half a minute without any tool. These are the steps, in the order that finds the most.

1. Read the domain, not the whole link

The part that matters is the domain: the words just before the first single slash. In https://login.example.com/path it is example.com. Everything to the left (login.) is chosen by whoever owns example.com.

• telegram.org.verify-session.com belongs to verify-session.com. Writing a real name first is a common trick.
• A name before an “@” (https://telegram.org@evil.example) is ignored; the site is whatever follows the “@”.

2. Look for look-alike letters

Attackers register names that look right at a glance: a digit for a letter (binanc3.com), a doubled or dropped letter, rn for m, or letters from another alphabet that look identical to Latin ones. If you type the name of the service yourself instead of clicking, none of this can fool you.

3. Be wary of short links

A shortened link hides where it goes. You can ask the shortener's own preview feature, or send the link to a tool that expands it for you without opening it as you.

4. Ask how old the site is

Fresh domains, registered days ago, are used for throwaway scams. Public registration data shows the date. A new domain is a clue, not proof: many scam sites are old hacked ones, and plenty of honest sites are new.

5. Notice what the page asks for

• A recovery phrase or private key: leave. No honest site asks.
• A wallet connection promising a bonus or airdrop: leave.
• A password on a page you reached from a message: go to the real site by typing it.

6. Prefer typing over tapping

For anything involving money, open the service by typing its address or using your own bookmark. A link in a message is only as trustworthy as the person who sent it, and accounts get hacked and imitated.

Where Plumbline fits

Plumbline does steps 1 to 5 for you on its own servers, so the link is never opened on your device: it reads the address, compares the name with a list of imitated brands, expands short links through up to five redirects, looks up the domain's registration date, reads what the page asks for, and checks a list of known phishing sites. It tells you what it saw and what it could not check. “No known threats found” is never a promise of safety.