How to check if a link is safe before you click it

What to check in a link before you click

A link is an address, and only one part of it really tells you something: the domain. It is the part just before the first single slash '/', read from the right. In 'https://olx.pl.parcel-delivery.com/collect' the domain is 'parcel-delivery.com'. The 'olx.pl' at the start is a subdomain that the owner can name anything.

The three tricks you see most often:

1. A known brand at the start of the address and an unrelated domain at the end (as above).

2. A domain similar to the real one: swapped letters, a hyphen, add-ons like '-pl', '-help', '-refund', a different ending.

3. An '@' sign in the address. The browser treats everything before it as a user name and opens what comes after it.

Some letters from other alphabets look exactly like Latin ones, for example the Cyrillic 'а' and the Latin 'a'. If a copied address contains a part starting with 'xn--', the domain uses non-Latin characters and deserves a closer look.

The text of a link and its address are two different things. The words 'www.mybank.com' in an email can lead somewhere else entirely.

How to preview a link without clicking

On a computer: hover the mouse over the link and do not click. The real address appears in the bottom left corner of the browser or in a tooltip in your mail app.

On a phone: press and hold the link. Choose 'Copy link' or 'Copy address', paste it into your notes and read it calmly. On an iPhone, holding a link in Safari shows a preview of the page and a menu; choose copy instead of open.

Text messages keep repeating the same pretexts: an extra parcel fee, an overdue electricity or gas bill, a fine, a tax refund, a blocked account, a prize. Each one is meant to make you click before you think. Check the real issue in the courier's, supplier's or bank's app, without the link from the message.

QR codes: the phone camera usually shows the address before opening it. Read it like any other link. A QR code stuck on a parking meter or a flyer can lead anywhere.

If you do not want to send the address anywhere, you can paste it into arLET'S: recognition happens in your browser and nothing is sent. You will see the domain and signals in the address itself (such as a shortener, non-Latin characters or login details in the address), but the link is not opened, so a short link is not expanded.

How to check if a link is safe online

1. The CERT Polska warning list (lista.cert.pl). In 2025 almost 245,000 domains were added to it. CERT Polska recommends that blocking systems download it every 5 minutes, and according to CERT it is used by the Polish operators Orange, Plus, Play and T-Mobile. A domain missing from the list is not proof the link is safe: fresh domains only appear after they are reported and analysed.

2. Domain age. For .pl domains, check the NASK registry WHOIS (dns.pl/whois); for others, ICANN Lookup (lookup.icann.org). A domain a few days old that imitates a courier, a bank or a classifieds site is a strong signal.

3. A free domain check in arLET'S. In domain mode you can check the CERT Polska warning list, the domain's age and status in the registry, similarity to known brands, email protection (SPF and DMARC), all in one result.

4. A URL scanner such as VirusTotal. It shows verdicts from many antivirus engines and, useful for short links, the redirect chain and the final address the link ends up on. Do not paste links that contain your own data, such as a password reset link or a link to a document, into external scanners.

Short links: how to check where they lead

A link shortener turns a long address into a short one and hides the real domain. That is not bad in itself, as companies use them in newsletters, but in a text from an unknown sender it is a way to hide where the link goes.

Do not open a short link 'just to see'. Expand it with a scanner that shows the redirect chain and the final address, and then check that address using the steps above. Remember that a link can redirect several times, and the final address can depend on the device you use.

How to check if a link in an email is safe

Start with the sender, not the link. If the sender's address is suspicious, so is the link. We explain how to check the sender, the domain and the headers in how to check if an email is real.

Then hover over the link and compare the address with the sender's domain. A bank writing from one domain and linking to a completely different one is a warning sign.

The simplest rule: if a link leads to a login, a payment or 'confirming your details', do not use it at all. Open the app or type the service's address yourself and check whether the same issue is waiting in your account.

How to check if an OLX link is safe

The 'fake buyer' scam goes like this: you sell something on OLX, Vinted or Allegro Lokalnie, a 'buyer' writes on WhatsApp or in chat and sends a link to 'receive payment' or 'confirm shipping'. The page looks like OLX, a courier or a bank and asks for card details or a banking login. Once you enter them, the account is emptied.

This is not rare. According to the CERT Polska report for 2025, campaigns misusing the OLX brand produced 28,462 incidents and Allegro 22,513. 28,562 domains impersonating OLX were added to the warning list.

Rules that cut this off: OLX replied on its blog (January 2023) that transactions with OLX delivery take place only on the OLX site or in its app, and that links sent by text or WhatsApp come from scammers. Vinted says you do not have to leave Vinted to confirm a payment or receive an order. A seller never needs to enter card details to get paid. Treat every buyer's link that takes you outside the app as a scam.

In Poland, forward such a text message to 8080, report the page at incydent.cert.pl, and send a fake message impersonating Vinted to phishing@vinted.com.

I clicked a suspicious link. What now?

Just opening a page is usually not enough to steal money, but it can lead to downloading a malicious file. Do not install anything the page asks for, and close the tab.

If you entered card or banking login details, call your bank straight away. Poland's Central Cybercrime Bureau also recommends freezing your national ID number (PESEL) in mObywatel. If you entered an email or service password, change it everywhere you used it. More next steps are in how to check if a website is safe and how to check if your data has been leaked.