Beginner · 6 min read
How to Spot a Suspicious Website URL
Learn how web addresses work and how small domain differences can reveal risky or fake websites.
Read the real domain name
The most important part of a website address is usually the domain near the end. In shop.example.com, the main domain is example.com. In example-login.security-check.com, the main domain is security-check.com, not example.com.
Attackers often add trusted brand names as subdomains or inside long URLs to make a fake website look real.
Look for spelling tricks
Be careful with small spelling changes, extra hyphens, unusual endings, and lookalike characters. For example, a fake address may use paypaI.com with a capital i instead of paypal.com.
A padlock icon or HTTPS connection does not prove that a website is safe. HTTPS only means the connection is encrypted; scam sites can also use it.
What to do before signing in
If a link comes from an unexpected message, do not sign in through that link. Open the official app or type the trusted website address manually.
If you are unsure, search for the company independently or ask its official support channel before entering information.
Learn responsibly
This guide is for educational use. Only test systems, accounts, and data that belong to you or where you have clear permission.