Don't trust the logo alone
Logos, colours, signatures and the wording of legitimate companies are easy to copy. More important are the actual destination domain, sender address and how you arrived at the page. HTTPS and a padlock mean an encrypted connection to the displayed domain, not proof that its content or operator is honest.
Warning signs
- Unusual urgency or threats to suspend your account.
- A request for a password, PIN, one-time code or payment card.
- A domain similar to the real one, but not identical.
- An unexpected attachment, QR code or shortened link.
- A demand to pay into a new account or bypass usual procedures.
- Pressure to avoid the official app, customer support or established contacts.
How to check a link without opening it
- On desktop, hover over the link to see its real destination. On mobile, long-press to preview it without opening immediately.
- Read the domain from right to left: in
login.example.com, the registered domain is generallyexample.com, notlogin. - Watch for added words, swapped letters and unexpected top-level domains.
- If a message claims to be from a bank, courier or other service, open the official app or manually enter the known website address.
A safer way to verify
Do not follow login links from suspicious messages. For an unfamiliar domain, WHOIS / RDAP lookup can reveal registration dates and the registrar. A very recent registration warrants extra caution but does not prove phishing. If a request is genuine, you can often see it inside the service's official account or app.
QR phishing and shortened links
QR codes hide destinations until scanned, and shortened links obscure the final domain. Before logging in or paying, check which hostname you reached. If a QR code in email opens a login page, close it and open the official app directly.
If you already clicked
If you did not enter anything, close the page and check for unexpected downloads. If you entered a password, change it through the official channel, sign out active sessions and enable multi-factor authentication if available. If you shared card details or made a payment, contact the bank or card issuer immediately. If you revealed a one-time code, act immediately because it may only be valid briefly.
What can splet.me confirm?
The technical website checker can show HTTP response, HTTPS, redirects and selected security indicators, while RDAP provides public domain registration details. Neither can prove a site is legitimate or fraudulent by itself. Verify business identity and requests through an independent official channel.
Frequently asked questions
Does HTTPS mean a link is not phishing?
No. Fraudulent domains can also use valid HTTPS certificates.
Should I reply to a suspicious message?
Usually not. Verify the request via an independent official channel.
Does a recently registered domain prove phishing?
No. It is only one indicator to consider alongside sender identity, the request and other verifiable information.
What should I do if I entered my password?
Change it as soon as possible through the official service, sign out other sessions and enable multi-factor authentication if available.