How do I identify the true hostname?
Look at the hostname shown in the result and read it from right to left. Be cautious when trusted-looking words appear only in a subdomain or before an @ symbol.
Reveal a link's real hostname, redirects, encoding, credentials, punycode, and structural warning signs.
Workspace
Review the real destination and warning signs before deciding whether to visit.
The registered domain is normally near the right-hand end. Text before it, including convincing brand words can be controlled by someone else.
Look at the hostname shown in the result and read it from right to left. Be cautious when trusted-looking words appear only in a subdomain or before an @ symbol.
Punycode is an ASCII representation of internationalized domain names. Some Unicode characters resemble familiar Latin letters, so the system shows both forms for comparison.
In a URL, username and password text can appear before @. The actual hostname comes after @, even when the earlier text looks like a trusted domain.
No. Structural inspection can reveal common tricks, but an ordinary-looking domain may still host malicious or compromised content.
Parameters such as redirect, next, target, or return can tell one site to send the browser elsewhere. Inspect both the outer and nested destination.