How to spot a phishing domain in ten seconds

Most phishing emails aren’t dangerous because of their wording. They’re dangerous because of one line: the address behind the button. Once you know how to spot a phishing domain, checking takes about ten seconds. The trick is not to read the address left to right the way you read everything else.

Spot a phishing domain: read it from the right

A web address is built right to left. On the far right is the extension (.com, .co.uk). Just left of it is the name someone registered. Those two parts together are the domain. Everything further left is a subdomain, and the domain’s owner can call subdomains whatever they like.

An example with a made-up bank at examplebank.com:

Row three is the classic. “examplebank.com” sits at the front and looks familiar, but the actual domain is account-verify.net. The last row is rarer and nastier: in a URL, anything before an @ is treated as a username, so the browser goes to verify-id.net.

A worked example

Say an email reads “Your account has been limited. Please confirm your details.” The preview shows the button links to https://security.examplebank.com-customer.info/verify.

Strip everything after the first single slash, leaving security.examplebank.com-customer.info. Now read from the right. The extension is .info, and before it is com-customer. So the domain is com-customer.info. The rest is a subdomain its owner made up. It has nothing to do with Example Bank.

The trick is the hyphen after .com. Your eye reads examplebank.com and stops. The name keeps going.

If you want certainty, copy the link without opening it and look up the registration date. Or take the easy route: close the email, open the bank’s site from your bookmark and see whether a message is really waiting. Genuine notices show up in your account without a link.

Warning signs of a phishing domain

No single sign proves anything. Two or three together, and you walk away.

• Brand plus extra word. examplebank-security.com, parcel-redelivery.net. Large companies usually keep services under their main domain.
• Typos and swapped letters. rn for m, doubled letters, a missing hyphen. More in typosquatting.
• An unfamiliar extension. Your bank is known under .co.uk and the link goes to .info or .top. The extension itself doesn’t make a site shady; the break from what you expect is the signal.
• Characters from other alphabets. A Cyrillic “а” looks like a Latin “a”. Browsers often display such addresses as xn--…. How that works is covered in homograph attack.
• A recent registration date. Phishing domains are usually registered shortly before the campaign.
• Shortened links and redirects. A short link in an email from “your bank” is unusual.

Checking a domain’s age and registrar

For generic extensions, WHOIS shows when a domain was registered and which registrar holds it:

whois suspicious-domain.com | grep -iE "creation date|registrar:|abuse"

The output typically includes Creation Date, Registrar and Registrar Abuse Contact Email. A creation date a few days old on a site posing as an established firm gives you your answer. The abuse address is what you need if you want to report it.

Certificate Transparency logs are a second, often overlooked source. On crt.sh you can see when the first TLS certificate for any domain was issued. A certificate from yesterday for a supposed major bank is a clear sign.

Why the padlock proves nothing

Many people learned that padlock means safe. It was never quite true, and today it isn’t true at all. Since certificate authorities like Let’s Encrypt began issuing free, automated certificates, practically every phishing site has one. The padlock confirms you have an encrypted connection to account-verify.net. It doesn’t tell you who is behind it.

Chrome replaced the padlock in the address bar with a neutral settings icon in 2023. Google’s reason: too many people read the padlock as a sign of trustworthiness.

Email senders follow the same rule

For email addresses, the domain after the @ is what counts. [email protected] comes from customer-mail.net. The display name (“Example Bank Support”) can be anything. On mobile mail apps, tap the name to see the real address.

What to do when you find one

Reporting a phishing domain protects other people. Google Safe Browsing, the registrar’s abuse desk and the hosting provider can block the site or trigger browser warnings. Who handles what is explained in report a phishing site.

If you run a brand yourself, flip the perspective: which variants of your name would appeal to fraudsters? A search for your brand name with a hyphen shows which are still free. The usual candidates are your brand under .com and your country extension, plus the two or three most obvious typos. What that costs at fixed yearly prices is on the price list for every extension.