Links are not what they seem.
A 10–14 minute lesson: URL anatomy, the read-backwards-to-the-domain ritual, and the three disguises phishing uses most.
How to take a URL apart piece by piece, read its real stop, and spot disguised domains, subdomain traps and opaque shorteners.
The case
The destination printed on a link is propaganda: the real stop lives elsewhere — and you can read it in three seconds.
In 10–14 minutes you'll master the station reader: take any URL apart, find its real stop, and see through the most common disguises.
What you will learn
- Take a URL apart piece by piece and locate the domain
- Apply the backwards reading in three seconds
- Decide the itinerary: open, avoid or verify each link
The station reader
Slash, read backwards: that's the stop. With that rule, no domain disguise gets you on the wrong train.
Pieces
Five parts, one rules.
Reading
Slash and backwards.
Disguises
Subdomain, lookalike, shortener.
Itinerary
Green, red or amber.
Frequently asked questions
What is a subdomain and why does it matter?
It's the label in front of the domain (login.banco.com). It matters because attackers use it as a decoy: banco.com.login.ru looks like the bank, but the real stop is login.ru.
Are link shorteners dangerous?
They aren't malicious by themselves — they're opaque: they hide the real stop until you expand them. With an unknown sender, better not gamble — verify through your own channel.
Test yourself: Lightning test: where does the train stop?
Which piece of the URL is the real stop?
Correct answer: The domain: the chunk right before the first slash, read backwards.
The domain rules: it's the one piece the ticket can't fake. Subdomain and path are decoy and decoration.
http://banco.com.login.ru/verify — at which station does it stop?
Correct answer: login.ru: banco.com is just a subdomain (decoy).
The platform's most used trick: the legitimate domain slips in front as a subdomain while the real stop hides at the end.
The link has a green padlock and HTTPS. Does that mean the destination is safe?
Correct answer: No: HTTPS secures the trip, not the honesty of the destination — phishers have it too.
The padlock is free to get on any modern scam site. It validates the encryption of the trip, never the identity of the destination.
The pocket rule — Don't read the printed destination: find the first slash and read backwards — that's the real stop. HTTPS secures the trip, not the honesty.
What you take away
Inspect any URL and uncover its real destination before clicking.