Phishing links in email: how to spot them and how to stop sending them

A phishing link is a URL whose purpose is to collect credentials, money or malware installs while appearing to belong to someone you trust. You can usually identify one without clicking, because the deception has to survive being written down in a URL — and that leaves marks. The second half of this problem belongs to senders: legitimate marketing links share several traits with phishing links, which is why they get filtered.

Read the registrable domain, not the whole URL

The only part of a URL that proves ownership is the registrable domain: the label immediately to the left of the public suffix. Everything else is attacker-controlled text.

Read right to left from the first single slash. If there is an @ before that slash, ignore everything to its left. If the hostname starts with xn--, it is an internationalised domain rendered as punycode, and the version your eye sees may use Cyrillic or Greek characters that look Latin.

Checks you can make in ten seconds

1. Hover and read the status bar in a desktop client. On mobile, long-press to preview the URL rather than tapping.
2. Compare link text to destination. Display text saying https://bank.example pointing at something else is the oldest trick and still the most common.
3. Expand shorteners. A bit.ly or t.co link in a message claiming to be from your bank, your IT department or a supplier is a red flag by itself; legitimate transactional mail almost never uses public shorteners.
4. Count the redirects. Chains that pass through an open redirect on a reputable domain (https://trusted.example/out?url=...) are designed to borrow that domain's reputation.
5. Look for `data:`, `javascript:` or `blob:` URIs. Nothing legitimate in email uses them.
6. Check for a login form on a non-login domain. A page hosted on free hosting, a form-builder subdomain or a cloud storage share that asks for your email password is phishing, with no exceptions worth worrying about.
7. Treat QR codes as links you cannot read. A QR in an email body bypasses every URL check above; most phones preview the destination before opening, so read it.

Link checkers worth using

• urlscan.io renders the page in a sandbox and shows you the redirect chain, requested domains and screenshots. Note that public scans are visible to everyone — never scan a URL that contains a token, an unsubscribe ID or anything personal unless you set the scan to private.
• VirusTotal aggregates many vendors' verdicts for a URL or file. Useful as corroboration; a single vendor hit is often a false positive.
• Google Safe Browsing is the engine behind the red warning page in Chrome. Google's Search Console shows security issues for domains you own.

A clean verdict from all three does not mean the link is safe — newly registered phishing domains are clean for hours. A dirty verdict is reliable; a clean one is weak evidence.

Is your own domain sending links that look like phishing?

This is the part that affects your deliverability. Signals that make a legitimate email look like phishing to a filter:

• A click-tracking domain on a shared or unrelated hostname. If your From domain is example.com and every link points at click.sometool.io, the message has the structural shape of a phish. Set up a tracking subdomain on your own domain with a CNAME, so links read https://links.example.com/....
• Public link shorteners. Shared shortener domains accumulate abuse from every other user. They also appear on URI blocklists such as Spamhaus DBL, URIBL and SURBL, and a listed link domain gets the whole message filtered regardless of your own reputation. (SORBS, long used for this kind of lookup, was shut down in June 2024 — if any tooling still queries it, remove the check.)
• Mismatched display text. Writing out one URL and linking to another is a tracking convention in some tools and a phishing signature everywhere else.
• Link-heavy, text-light HTML. A message that is one image and one button, with no readable text, scores badly.
• A newly registered sending or link domain. Age is a real input. A domain registered last week with no sending history, linking to a second domain registered last week, is treated accordingly.

If your domain is actually sending phishing

Assume a compromised mailbox until proven otherwise. In order:

1. Reset the credentials and revoke sessions for the affected mailbox.
2. Check for third-party OAuth app grants and remove anything unrecognised — this is the most commonly missed step, because a revoked password does not revoke a token.
3. Check mailbox rules: attacker-created forwarding and "delete all replies" rules are standard.
4. Review the mail audit log for mass sends and for changes to delegation.
5. Read your DMARC aggregate reports (rua) for sources you do not recognise. Spoofing without a compromise shows up here as unauthenticated sources, and the fix is a DMARC enforcement policy rather than a password reset.
6. Check your domain and link domain against the major blocklists, and request delisting once the abuse has stopped — delisting while you are still sending will not hold.

If you clicked

Disconnect nothing dramatic; act precisely. If you only loaded the page, close it and run a malware scan. If you entered credentials, change that password and anything reusing it, revoke active sessions, and enrol in a second factor — ideally a passkey or hardware key, since one-time codes can be relayed in real time. If you entered card details, call the issuer. If it was a work account, report it immediately: the value of the report is that security can find out who else received the same message.

A short team checklist

• Phishing-resistant second factor on email, DNS and payments accounts
• DMARC at p=reject on your sending domains, with aggregate reports being read
• A one-click internal reporting path, and no blame for using it
• Link tracking on your own subdomain, never a public shortener
• Quarterly review of OAuth grants and mailbox forwarding rules
• A standing rule that payment-detail changes are confirmed by phone, never by email

MailPilot helps on the sending side of this: it checks SPF, DKIM and DMARC on your domains and measures where real mail from your mailboxes lands at each provider, which is how you find out that a link domain or a tracking subdomain is dragging your messages into spam.