Copy the address without navigating to it, inspect the destination, and check whether it contains sensitive information. If investigation is necessary, review reputation findings and use an approved isolated analysis service to examine page behavior. Then verify the request through a trusted channel. No scanner can guarantee that a link is safe.
“Without opening it” means without visiting the destination in your own browser. A dynamic analysis service opens it in a separate environment. That visit can still contact the website, trigger tracking, or consume a one-time link.
On this page
- First, decide whether you need to investigate
- Step 1: Copy the address without navigating to it
- Step 2: Inspect the destination and context
- Step 3: Check sensitivity before sharing
- Step 4: Check existing reputation when useful
- Step 5: Review an isolated visit if needed
- Step 6: Interpret observations in context
- Step 7: Decide and preserve useful evidence
- What if you already clicked?
- Frequently asked questions
- Choose a tool when analysis is necessary
First, decide whether you need to investigate
You do not need to prove a link is malicious to decline an unexpected request. If a message claims your account needs attention, open the company's official app or a known bookmark. For a work message, use your organization's reporting process.
The FTC recommends contacting a company through a phone number or website you already know is real, rather than using contact details in the suspicious message. FTC phishing guidance.
Continue with analysis when you need evidence—for example, to help your security team understand a reported message.
Step 1: Copy the address without navigating to it
On a desktop, use the link's context menu and select the option to copy its address. On mobile, use a copy-link option if your app provides one without loading a preview. Some interfaces preview destinations when you press and hold; if you cannot copy the address safely, report the original message instead.
Paste the address into a plain-text editor that does not automatically fetch link previews. Do not paste it into the browser's address bar and press Enter. The displayed words in a message can differ from the actual address behind them.
Step 2: Inspect the destination and context
Look at the actual hostname, not merely a familiar brand name appearing somewhere in the address. These deliberately fictional examples show why placement matters:
| Address shown as text | What it tells you |
|---|---|
https://accounts.example.com/login |
The hostname is a subdomain of example.com |
https://accounts.example.com.verify.example.net/login |
The hostname belongs under example.net, despite the familiar-looking prefix |
https://example.net/login?brand=example.com |
The query text does not change the destination hostname, example.net |
For these examples, the distinction is clear; real domain suffixes can be more complex. If an address contains unfamiliar encoding or a structure you cannot confidently interpret, ask for help rather than guessing.
Check whether the sender, destination, and request fit together. A shortened URL hides its destination; a misspelling or unexpected domain merits scrutiny. A valid HTTPS connection protects transport but does not prove the organization behind the page is trustworthy. Link warning signs and HTTPS explanation.
Step 3: Check sensitivity before sharing
Treat links containing access tokens like access credentials. Password-reset links, private file links, account invitations, and signed download URLs may grant access to whoever receives them. A path or query can also reveal customer or employee information.
Do not submit a sensitive work URL to a public scanner unless your organization's process allows it. Removing a token may change what the page does, so a scan of the edited address cannot establish the behavior of the original.
Privacy settings differ. VirusTotal's standard service shares reports; its Private Scanning offering is separate. urlscan's Unlisted scans are still available to vetted Pro users. Blue Lantern retains user-only reports for one week, but its policy does not separately specify raw-URL retention. See the three-tool privacy comparison before choosing where to submit.
Step 4: Check existing reputation when useful
Reputation findings help answer whether available security sources have flagged a destination. Review individual findings and their timing rather than relying only on a total.
VirusTotal aggregates contributing sources and can provide vendor labels and context. Its results are one evidence source, not proof that an unflagged link is legitimate. VirusTotal methodology.
A lookup of just the domain reveals less about a specific path. If you deliberately checked a less-sensitive version of a URL, record that limitation. If you already have enough evidence to reject or report the message, there is no obligation to keep scanning.
Step 5: Review an isolated visit if needed
Dynamic URL analysis observes a destination in a separate environment so you can inspect findings without visiting it on your device. Choose an approved tool and sharing mode, submit the address, and wait for the report to complete.
Blue Lantern's URL Detonation Engine provides behavior findings; urlscan.io provides browser artifacts including screenshots and DOM captures. Their documented capabilities are described in the Blue Lantern listing and urlscan scanning API.
Read the report itself. Do not click captured links, open downloaded samples, or enter real credentials to “finish” the investigation. If the page requires interactions beyond the available analysis, escalate it to someone with an appropriate investigation environment.
For more on Blue Lantern's workflow, see Is This Link Safe?.
Step 6: Interpret observations in context
| Observation | What to consider | A reasonable next step |
|---|---|---|
| Redirect to another domain | Expected authentication and tracking can redirect too | Compare the final destination with the request; verify independently |
| Login form on an unexpected destination | Could indicate impersonation | Keep credentials out of the page and verify the request |
| Download you did not request | Could be unwanted or malicious | Do not open it; share findings through the approved reporting process |
| Newly registered or lookalike domain | A signal needing context, not proof by itself | Examine the hostname and other evidence together |
| Instructions to paste a command | Can be a ClickFix lure | Do not run it; report the message or page |
| No suspicious findings | Limited to that analysis and its conditions | Continue to assess the sender and requested action |
| Timeout, blocked visit, or incomplete redirect | The destination was not fully assessed | Treat it as unresolved |
Microsoft documents ClickFix attacks that persuade users to execute commands under a supposed verification or repair pretext. A CAPTCHA asking you to open a terminal and paste instructions is not a reason to comply. Microsoft ClickFix research.
A site can change between visits, respond differently to different environments, or hide behavior behind an interaction. Do not translate “nothing observed” into “nothing can happen.”
Step 7: Decide and preserve useful evidence
Your decision should reflect the request and the evidence, not just the scanner label.
For a work investigation, record the original message, received time, the address actually analyzed, analysis time, key findings, and whether the scan completed. Keep sensitive addresses and reports in approved storage. Use your team's reporting channel instead of posting a report publicly.
If the message is suspicious or unresolved, verify it with the claimed sender through a known channel. If the link is unnecessary, leave it unopened. For Blue Lantern, download any report you need to retain within its one-week lifetime. Privacy Policy.
Example: an unexpected shared document
Suppose an unexpected email asks you to sign in to view an invoice. You copy the link and find an unfamiliar destination. An approved analysis shows another redirect followed by a login page, while reputation findings show no detections.
You contact the supposed sender using an existing contact record. The sender says they did not send an invoice, so you report the message and keep the page closed. The lack of detections never became permission to sign in.
This is an illustrative scenario, not a real customer incident or measured product result.
What if you already clicked?
Close the page and stop interacting with it. Tell your IT or security team what happened, including whether you entered a password, approved a sign-in, downloaded a file, or ran a command. Those actions require different follow-up; a later clean URL report does not reverse them.
If you entered a password, use the service's known app or website to change it and review account access. If you suspect harmful software was downloaded, the FTC advises updating security software and running a scan. Follow your organization's incident process on a work device. FTC response guidance.
Frequently asked questions
Can I check a link without the website receiving any request?
Copying text alone does not require visiting the destination, but previews and analysis services may fetch it. Dynamic analysis intentionally makes a visit. Do not assume a tool is passive unless its documented behavior supports that conclusion.
Is incognito mode a safe sandbox?
No. A private-browsing window is still a browser on your device. It does not make an untrusted page safe to visit or a downloaded file safe to open. Use an approved analysis environment when an investigation requires a visit.
Should I expand a shortened link first?
You need to understand the final destination, but an expander is another service receiving the URL and may visit it. An approved tool that reports redirects can handle that step. If the chain does not complete, the destination remains unresolved.
What if the link came from someone I know?
A familiar name is not enough to establish that a message is genuine. Verify unusual requests using a known contact method, especially when they involve payment, login, or sensitive information.
Can I use Blue Lantern for this workflow?
Yes. Its URL tool reports observed behavior, and its Email Analyzer can add message context. The free tier includes 30 daily runs shared across URL detonation, email analysis, and static malware analysis. An account is required; API access and monitoring require a seat. Current plans.
Choose a tool when analysis is necessary
Compare URL scanners and link checkers, or open Blue Lantern's URL Detonation Engine.
Related reading: