Guide · Link risk · September 2026
Read It From the Right
A web address tells you exactly where it goes. It just doesn't tell you in the order you read it.
You've been told to check a link before clicking it. That's good advice, but most people check the wrong part.
A link can carry a familiar company name and still land somewhere else entirely. The name might sit in a subdomain, in the path, or before an @ sign. On a phone, the real domain may be cut off unless you expand the link first.
One habit fixes most of this:
Read the domain from the right.
This guide shows you how to inspect a link without opening it. It won't prove a link is safe. It will help you catch the common tricks before you click.
Below: the main tricks, how to check for each one without opening anything, and what a structural scan can and can't tell you.
01Where an address points
Take this address:
The browser splits it into a scheme, a host, and a path. The host is where you actually connect. The path is chosen by whoever runs that host, and it can say anything they want.
https://schememetamask.io.subdomain — chosen by the owner belowsecure-verify.exampleregistrable domain — the destination/loginpath — chosen by that same owner
The four parts of https://metamask.io.secure-verify.example/login, in order.
Inside that host, the registrable domain is secure-verify.example. Everything to its left is a subdomain, controlled by whoever owns secure-verify.example. An owner can create as many subdomains as they like and name them more or less freely — including naming one metamask.io.
So metamask.io isn't the destination here. It's just a label on the left.
What "registrable domain" means
The part that matters is the registrable domain: the name a person or company can actually register. It's the public suffix plus the one label in front of it. Often that looks like example.com. With some country-code structures it looks like example.co.uk or example.com.au.
Browsers and security tools use public-suffix data to find that boundary. Don't assume every suffix uses the same number of labels. The practical instruction is:
then take the label just before it.
That's the registrable domain.
This boundary isn't a footnote. Our own scanner counted labels until 19 September 2026, decided the owner of coinbase.co.uk was co.uk, and flagged an ordinary legitimate link as brand impersonation. A tool that shouts about real websites gets switched off, and then it protects nobody. What changed, and what it still can't work out, is in Technical Transparency.
02The name on the left
A trusted name can sit in a subdomain or in the path without controlling anything.
https://metamask.io/download
https://metamask.io.wallet-check.example/download
The same trick works in the path, where it reads even more naturally:
In both misleading examples the registrable domain is wallet-check.example or cdn-assets-9931.example. The brand name only appears in a spot that domain's owner gets to fill in.
On a phone, a long address can push the real domain out of view. Expand or copy the link before you judge it.
03Lookalike characters
Here there's nothing clever going on in the address. Someone registers a domain that simply looks like another one.
| Familiar spelling | Lookalike | What changed |
|---|---|---|
metamask | metarnask | rn can pass for m |
paypal | paypa1 | digit 1 can pass for lowercase l |
binance | b1nance | digit 1 can pass for lowercase i |
At this size the difference is obvious. In an address bar, it often isn't.
A lookalike domain is a real domain. This isn't a browser bug. It works because our eyes round off similar shapes.
Look at the third row: the same character stands in for a different letter than it did in the second. That's why catching this by machine is harder than it sounds — fix one spelling and you catch paypa1 while walking straight past b1nance. Our scanner tries several ways a name could be read instead of reducing it to one.
A related version needs no lookalike characters at all. It just bolts extra words onto the real name:
Each of those puts the brand at the registrable-domain position. The name isn't misplaced and isn't misspelled. It just has company. Companies do legitimately run several domains, so this isn't proof of anything on its own — but an unfamiliar brand-plus-word domain shouldn't be treated as official just because the brand is in it.
Don't trust your eyes alone. Compare the domain against something you already trust: a saved bookmark, or the official app.
04Internationalized and punycode domains
Internationalized domain names let people write domains in scripts like Greek, Cyrillic, Arabic and Chinese. So that older systems still work, many of these names also have an ASCII form that starts with xn--. That's punycode.
Punycode isn't automatically a red flag. Plenty of legitimate organizations use internationalized domains. But an unexpected punycode link deserves a closer look, especially in a message you didn't ask for about money, account access, or urgent verification.
Several Cyrillic letters are drawn much like Latin ones — а, е, о, р, с — so a substituted name can look almost identical on screen while being an unrelated domain on the network.
Browsers may show the Unicode form or the ASCII form, depending on the domain and the browser's own rules. A scanner can spot punycode without being able to prove what the rendered name looks like. Flagging punycode marks something for review; it doesn't prove fraud.
05The @ sign
In an HTTP or HTTPS URL, anything before @ is user information. It is not the destination host.
https://schemeledger.comuser information — not the destination@separatorledgerlive-verify.examplehost — the site you reach/devicepath
The five parts of https://ledger.com@ledgerlive-verify.example/device, in order.
The host is ledgerlive-verify.example. The text ledger.com is not the site you're visiting.
This is the trick that survives careful reading, because the familiar name really is there, really is part of the address, and really is spelled correctly. A familiar name before @ proves nothing about who owns the link.
06Shortened links and QR codes
A shortened link hides the destination until you expand or follow it. Services like bit.ly, t.co and cutt.ly are ordinary and widely used for good reasons — which is part of what makes them useful cover.
A QR code hides the address completely. The code may be fine, but you can't inspect the destination from the image.
Our scanner flags shorteners it recognizes but doesn't resolve them for you. If it followed a stranger's link, it would contact the attacker's server and tell them the link had been inspected.
If you need to expand a short link, use a service you trust, and treat whatever comes back as untrusted until you've checked it.
07A worked example
Read it the way it would actually arrive: on a phone, in a notification, about a device you own.
Fictional example · reserved domains
Nothing in that message asks for anything secret. No recovery phrase, no private key, no password. It asks for a click — and that's the attack, because the page on the other side can make the next request once you're there.
Show me what is wrong with it
The message uses several tricks at once:
- The main link puts
ledger.combefore@, where it's user information rather than the destination. The host isledgerlive-verify.example. - That host carries the brand name with extra words attached, at the registrable-domain position — so it still reads as official once you've found the right part of the address.
- The fallback uses a punycode domain, offered as a helpful mirror. The sentence before it explains in advance why the first link might fail, so a failure feels anticipated rather than suspicious.
- It adds urgency and a consequence: 48 hours, and outgoing transfers described as paused.
- It asks only for a click. The page on the other side makes the next request once you're there.
The detail doing most of the work is the restriction itself. The message gives a technical-sounding explanation for a state the recipient can't independently verify, and believing it costs nothing in the moment.
Our engine returns FAIL on this message — on the @ link, the punycode host, and the brand-with-extra-words domain. It gets there without interpreting a single sentence of the English.
08How to read an address before you open it
Stop at the first single slash after the host begins
Everything after that slash is the path. It can say anything and proves nothing about who owns the site. If there's an @ before the path, ignore everything to the left of it when you're working out the host.
Find the host and read it right to left
Find the public suffix and the label just before it. Together, that's the registrable domain.
Compare it with the exact domain you meant to visit
Not "does this look official", and not "does it contain the brand".
If the address is cut off, expand it before deciding
Better still, open the service through your own bookmark, your saved app, or an address you typed yourself.
Don't click first and inspect later.
Inspect before you arrive.
09What the scan can and can't tell you
Paste a message into the scanner and it checks the structure of the addresses and links it covers, looking for the usual warning signs.
The scan itself contacts nothing. It runs in your browser, and no link in the message is fetched or resolved. If you then press Check this address on a crypto address the scan found, that address — and nothing else from the message — goes to the address-security provider. That's a separate step you choose to take, and Technical Transparency lists exactly what each provider receives.
| The scan can help identify | The scan cannot prove |
|---|---|
@ user-information tricks | That a structurally normal site is legitimate |
| Bare IP hosts | That the sender is who they claim |
| Recognized shorteners | That a shortened destination is safe without resolving it |
| Punycode indicators | What every punycode domain looks like when rendered |
| Brand names in suspicious positions | That a plain misspelling is malicious |
| Brand names with extra words attached | That a clean result means no scam exists |
| Some confusable characters | That a website will behave safely once you open it |
| Suspicious encoded URL content | Who owns a domain on a suffix it can't resolve |
| Supported crypto addresses in the message | That an address with no findings belongs to who you think |
Structure is not reputation.
A clean result means only that no covered structural trick turned up in the text you submitted. It doesn't mean the link, the website, the sender or the offer is safe.
Three limits are worth stating on their own.
A domain with no trick in it is invisible to a structural check. wallet-refund-centre.example has no lookalike character, no brand name, nothing out of place. Registered this morning and hosting a convincing copy of a wallet login page, it would pass this check and most others like it. Reputation systems — services that keep lists of known-bad addresses — answer a different question, and this scanner doesn't do their job.
Plain misspellings aren't reliably caught. metamsk.io is a typo, not a confusable-character substitution. The scanner doesn't catch every one of these. That's a known limitation, not a quiet promise.
Punycode is identified, not translated. The scanner can tell you a domain is in punycode form. It can't always tell you what name that form spells out.
The rule
The familiar name being there is not evidence. Find the registrable domain.
It's the cheapest thing in the whole address to put there — and the part a reader is most likely to stop at.
Every address in this guide that demonstrates a trick points at a reserved example domain. Those destinations don’t resolve and aren’t real services. The one live domain printed here is metamask.io, MetaMask’s actual site. It appears in section 2 as the correct case, because showing where a brand name genuinely belongs takes a genuine address to contrast against the misleading ones.
The example message is fictional. Related: what the page on the other end of a link tends to ask for, text that renders as nothing at all, and instructions written for an AI rather than for you. This article is for educational purposes only and is not financial advice.