How can I tell if a URL is phishing?

Read the domain right-to-left from the final TLD. The 'registrable domain' is the part immediately left of the TLD (.com, .ru) — everything before it can be faked. Watch for swapped characters, look-alike Unicode letters, extra hyphenated words, and an @ symbol that hides the real host.

What is a homograph attack?

A homograph attack uses Unicode characters that look like Latin letters — for example a Cyrillic 'о' (U+043E) in place of the Latin 'o'. The domain looks identical but resolves to a different host, which browsers reveal as a punycode (xn--) domain.

Why is the @ symbol in a URL dangerous?

Anything before the @ in a URL is treated as user credentials, not the hostname. So https://amazon.com@evil.tld actually connects to evil.tld. Attackers use it to make malicious links look like they point at a trusted brand.

Phishing URLs: How Attackers Fake Domains (and How to Read Them)

Most phishing doesn't rely on some exotic exploit. It relies on you reading a domain left-to-right and stopping at the first familiar word. Attackers know exactly where your eye lands — and they put a trusted brand name there while the real domain sits somewhere else.

The good news: there are only a handful of tricks, and one reading habit defeats nearly all of them.

Read every domain right-to-left

A URL's true owner is the registrable domain — the label immediately to the left of the final TLD, plus that TLD. In https://accounts.google.com/signin, that's google.com. Everything to the left (accounts.) is a subdomain the owner controls; everything to the right of the first slash is a path. Neither tells you who owns the site.

Click through these examples and watch where the browser actually connects:

Read the domain right-to-left — what host does the browser really reach?

🔒https://www.paypal.com/login

Browser actually connects topaypal.com

✓ Legitimate

Correct spelling, correct .com TLD, no userinfo or subdomain tricks.

The five tricks behind most phishing

1. Typosquatting — paypa1.com, micros0ft.com. A swapped character your eye autocorrects. The domain is real, registered, and not theirs.

2. Subdomain deception — apple.com.secure-login.ru. The brand appears, but as a subdomain. The registrable domain (read right-to-left) is secure-login.ru. The attacker owns everything to the left of it.

3. The @ (userinfo) trick — https://amazon.com@evil.tld/login. Everything before the @ is treated as a username, not a host. The browser quietly connects to evil.tld.

4. Homograph / punycode — faceboоk.com where the о is Cyrillic (U+043E). It looks identical but is a different domain; browsers display it as xn--.... When in doubt, retype the domain by hand rather than clicking.

5. Hyphen + plausible word — netflix-billing.com, apple-support.com. Adding a believable word with a hyphen mints a fresh, unrelated domain that reads like an official one.

A 10-second checklist

Find the final TLD, then read one label left — that's the real owner.
Is there an @ in the authority? Whatever follows it is the real host.
Any digits or accented letters substituting for normal ones?
Is the "brand" actually a subdomain of something else?
Unsure? Don't click. Type the known domain yourself or use a bookmark.

Train the instinct

Reading this is one thing; spotting it in half a second when an email says "your account will be suspended" is another. That speed only comes from reps.

The Spot the Phishing URL game throws eight URLs at you on a timer and asks you to name the trick — typosquat, homograph, subdomain, or the @ trick — before the clock runs out. It's the fastest way to turn this checklist into reflex.