How to tell who really owns a link: read the domain from the right
Every web address has exactly one owner: the name just to the left of its public ending. Everything further left is decoration the owner chose, and anything after the first single <code>/</code> is just a page on their site. Phishing links work by filling the decoration with names you trust.
The parts of a link
https://login.bank.com.secure-check.co.uk/account?next=https://x.example
\____________/ \__________/ \___/
subdomain owner name public suffix
\_______________________________/
hostThe owner, often called the registrable domain, is the public suffix plus one more label: here secure-check.co.uk. Whoever registered that name controls every subdomain in front of it, so they can make login.bank.com say anything they like.
Why “the last two parts” is wrong
Some endings are two or more labels long. co.uk, com.au and gov.uk are public endings like .com, so the owner of shop.example.co.uk is example.co.uk, not co.uk. Services that give out subdomains to their users add their names too: alice.github.io is owned by alice, not by GitHub. The list of all these endings is the Public Suffix List, which browsers use to decide which sites may share cookies.
Common tricks, and how to read them
| Link | Real owner | The trick |
|---|---|---|
https://[email protected]/login | evil.example | Anything before @ is a user name and is ignored |
https://bank.com.verify-account.example | verify-account.example | A trusted name placed in front as a subdomain |
https://paypa1.example | paypa1.example | The digit 1 standing in for the letter l (also 0 for o, rn for m) |
https://аpple.com (first letter Cyrillic) | xn--pple-43d.com | A look-alike letter from another alphabet; browsers may show the xn-- form |
http://3232235777/ | The IP address 192.168.1.1 | An IP written as one big number; no name at all |
https://real.example/out?url=https://evil.example | real.example, then evil.example | A redirect parameter that passes you somewhere else |
https://real.example/invoice.pdf.exe | real.example | Not an owner trick, but the file is a program, not a PDF |
Turning 3232235777 into 192.168.1.1 is just base conversion: write it in hexadecimal (C0A80101) with the number base converter and read the four bytes. Links stuffed with %2F and %40 hide their structure; decode them first with the URL encoder and decoder, which also breaks a link into its parts.
Getting it right in code
Splitting on dots and keeping the last two parts gets .co.uk, github.io and thousands of others wrong. Use a library that ships the Public Suffix List:
| Language | Library |
|---|---|
| Python | tldextract (tldextract.extract(url).registered_domain) or publicsuffix2 |
| JavaScript | tldts (getDomain(url)) or psl |
| Go | golang.org/x/net/publicsuffix (EffectiveTLDPlusOne) |
Or call the free, keyless link X-ray API, which never opens the link and returns the owner, the public suffix, decoded query parameters and plain-words warning flags:
curl "https://api.oddlathe.com/v1/url/inspect?url=https://[email protected]/login"Remember that this only reads the text of the link. A correct owner tells you who runs the page, not whether they are honest, and a real company’s site can still be hacked.
For people who just want to stay safe
Don’t log in through a link in a message. Type the address you already know, or use your own bookmark. If you’d like to practise spotting fakes, the sneaky inbox lesson has eight made-up messages to sort and a link X-ray to play with.
Related
Checking where a QR code goes before you open it · Why a browser warns about a site’s certificate: certificate has expired. How redirects work: 301 vs 302 vs 307 vs 308 and ERR_TOO_MANY_REDIRECTS.
Questions
How do I find the real domain of a URL?
Take the host, between // and the next /, ignoring anything before an @. Read it from the right: the public ending (like .com or .co.uk) plus the one word before it is the owner.
Who owns login.bank.com.example.net?
example.net. Everything to the left of the owner name is a subdomain that the owner of example.net chose, so it can say anything.
Why is splitting a domain on dots and taking the last two parts wrong?
Many public endings have more than one part, such as co.uk, com.au or github.io. Use a library based on the Public Suffix List, such as tldextract in Python or tldts in JavaScript.
What does an @ sign in a link do?
Everything before the @ is treated as a user name and ignored when choosing the site, so https://[email protected] goes to evil.example.
Published · updated .