Start with the sender and the destination, not a security score. If an unexpected message asks you to sign in, pay, or fix an account urgently, open the service’s official app or type its known address yourself. You often do not need to open the message’s link at all.
Read the destination without visiting it
On a computer, hover over a link to inspect the destination shown by the browser or mail app. On a phone, a long press may reveal it, although some apps also load a preview. If you want to avoid any preview request, use the app’s copy-link option where available and inspect the text without opening it.
Check the actual hostname. In https://accounts.example.com/login, the service belongs to example.com. In https://example.com.other-site.test/login, the hostname ends in other-site.test. A familiar name anywhere in the string is not enough.
| Clue | What it tells you | What it does not prove |
|---|---|---|
| HTTPS or a padlock | The connection is encrypted. | The operator is honest. |
| A shortened URL | The final address is hidden. | Whether the destination is safe. |
| No scanner detections | No listed engine flagged the checked item at that time. | That a new phishing page is harmless. |
| A trusted sender’s name | The message claims that identity. | That the account or displayed name is genuine. |
Use scanners with a privacy check first
A URL-reputation tool can add context, especially for a public link. VirusTotal’s search documentation explains its reports. Its URL submission documentation also warns that submitted indicators can enter its dataset.
Do not paste private document links, password-reset links, login tokens or confidential addresses into a public scanner. Removing a private token changes what is being checked, so the safer choice can be to avoid submission and contact the service directly. A scanner may fetch the page; it is not simply a local text inspection.
Act on the request, not just the URL
- Ask whether you expected this message or transaction.
- Compare the destination with the service’s known domain.
- Verify urgent requests through an independent contact route.
- Use the official app or a saved bookmark to check the account.
- Report or delete an obvious phishing message instead of exploring it.
For broader habits, see our safe-browsing guide. If Windows blocks a downloaded file, our virus-detected troubleshooting guide explains why a download warning needs separate attention. A good-looking page and an undetected link do not justify turning off protection.
Frequently asked questions
Does HTTPS mean a website is trustworthy?
No. It encrypts the connection but does not verify the honesty of the content or operator.
Can I put a password-reset link into a public scanner?
Avoid it. The link may contain a private token, and a scanner may fetch or share submitted information.
Does a clean scan guarantee safety?
No. New threats and deceptive pages can be missed, and reports describe what was checked at a particular time.
What is the safest response to an unexpected account warning?
Open the official app or enter the known website address yourself and check the account there.