Stop & Verify
Menu
Check the signs

Practice · Web addresses

Who really controls this link?

Scam links put famous names in places that do not matter. One habit — reading the address from the right — shows you the part that does.

5 minute lesson10 practice addressesUpdated 23 September 2026

Step by step

Find the registrable domain.

Every web address contains one name that someone registered and controls. Everything else in the address is chosen by that owner. Finding that name is the core skill.

https://login.harbourbank.example/account/settings

  • Connection type
  • Subdomain
  • Registrable domain
  • Path
  1. Cut off the rest. Ignore everything from the first single slash, question mark or # after the name. Words there — including brand names — are chosen by whoever owns the site.
  2. Find the ending. Look for the last part of the name, such as .com, .org or .net.
  3. Step one label to the left. The label before the ending, together with the ending, is the registrable domain. In the example above, that is harbourbank.example.
  4. Compare it with the one you know. If it is not exactly the domain you already trust, treat the link as unverified.

Country endings

Some endings have two parts.

Several countries use two-part endings such as .co.uk, .com.au or .co.nz. With those, the registrable domain includes one more label. In www.bbc.co.uk, the registrable domain is bbc.co.uk — not co.uk.

Shared services

A real domain can still host a fake page.

Some services let anyone publish: form builders, file-sharing links, website builders and code-hosting pages. A page made there shows the service’s genuine domain even when a scammer created it, which is why phishing pages often hide on well-known platforms. If an unexpected link on a shared service asks you to sign in or pay, go to the organisation’s own site or app instead.

Common tricks

Six ways a link borrows trust.

The brand as a subdomain

harbourbank.example.account-review.example

A familiar name at the start of the address, placed in front of someone else’s domain.

The brand in the path

secure-login.example/harbourbank/verify

The name appears after the first single slash, where the owner can type anything.

A swapped character

harb0urbank.example

A zero for an ‘o’, ‘rn’ for ‘m’ or a capital ‘I’ for a lower-case ‘l’. One character is a whole new domain.

An added word

harbourbank-support.example

Words such as secure, support, login or verify attached with a hyphen create a different domain.

The @ disguise

harbourbank.example@account-check.example

An @ before the first single slash turns everything in front of it into a login name. The browser goes to the domain after it.

A hidden destination

short.example/p8Xq2

Link shorteners and QR codes hide the final address until after you open them.

The padlock

What https does not tell you.

The padlock and https mean that the connection between your device and the site is encrypted, so other people on the network cannot read it. They say nothing about who runs the site. Scam pages routinely use https too.

Look-alike letters

Letters from other alphabets.

Some letters in other alphabets look identical to Latin ones. Browsers often reveal addresses that mix alphabets in an encoded form beginning with xn--. If you see xn-- in a link you did not expect, treat it with suspicion.

Reading addresses is a useful check, not a guarantee. For banks, email and anything involving money, the safest habit is to use a bookmark or the official app — then there is nothing to decode.

Practise

Ten addresses. Where do they go?

Harbour Bank and Parcelwise are fictional. Every address uses the reserved .example ending, which cannot be registered, so none of them lead anywhere.

0 of 10 answered0 correct
  1. Address 01A sign-in link inside the bank’s own app

    Harbour Bank’s real domain is harbourbank.example. Where does this link really go?

    https://www.harbourbank.example/login

    Is https://www.harbourbank.example/login the real site?
  2. Address 02A text message about a blocked payment

    Harbour Bank’s real domain is harbourbank.example. Where does this link really go?

    https://harbourbank.example.account-review.example/login

    Is https://harbourbank.example.account-review.example/login the real site?
  3. Address 03An email asking you to confirm your details

    Harbour Bank’s real domain is harbourbank.example. Where does this link really go?

    https://secure-login.example/harbourbank/verify

    Is https://secure-login.example/harbourbank/verify the real site?
  4. Address 04A link on the bank’s security page

    Harbour Bank’s real domain is harbourbank.example. Where does this link really go?

    https://login.harbourbank.example/security

    Is https://login.harbourbank.example/security the real site?
  5. Address 05A pop-up warning about unusual activity

    Harbour Bank’s real domain is harbourbank.example. Where does this link really go?

    https://harb0urbank.example/account

    Is https://harb0urbank.example/account the real site?
  6. Address 06A text saying a parcel is waiting

    Parcelwise’s real domain is parcelwise.example. Where does this link really go?

    https://short.example/p8Xq2

    Is https://short.example/p8Xq2 the real site?
  7. Address 07An email about a redelivery fee

    Parcelwise’s real domain is parcelwise.example. Where does this link really go?

    https://parcelwise.example@redelivery-fee.example/pay

    Is https://parcelwise.example@redelivery-fee.example/pay the real site?
  8. Address 08The tracking link in your order confirmation

    Parcelwise’s real domain is parcelwise.example. Where does this link really go?

    https://track.parcelwise.example/?ref=GB8841

    Is https://track.parcelwise.example/?ref=GB8841 the real site?
  9. Address 09A search advert for ‘parcel support’

    Parcelwise’s real domain is parcelwise.example. Where does this link really go?

    https://parcelwise-support.example/help

    Is https://parcelwise-support.example/help the real site?
  10. Address 10A message asking you to reschedule a delivery

    Parcelwise’s real domain is parcelwise.example. Where does this link really go?

    https://parcelwise.example.track-parcel.example/redeliver

    Is https://parcelwise.example.track-parcel.example/redeliver the real site?

Keep going

Your score appears when every address is answered.

Nothing you choose is saved or sent anywhere.

Try the scam drills

Where this matters most

Links in texts, emails and QR codes.

See how these tricks appear in real-looking messages, and what to do instead of clicking.

QR code phishing →Fake delivery texts →Bank impersonation →