A message has a link that starts with a well-known platform name but is long and encoded. How can I tell which site it really opens?

The @ trick

In a URL, whatever sits right after https:// and before an @ is treated as a login user name, not as the site. The real site is what comes after the @. Scammers use this by putting a familiar platform name at the front: your eye reads the known name and relaxes, while the link heads somewhere else entirely.

Here is a test link in that pattern, with a well-known platform name at the front:

https://salla.sa@login-check.example/verify?next=%2Fpay

Pasted into the tool, the 'URL parts' table showed the host as login-check.example, with a warning above it: 'The URL contains a user name or password before the host. Do not share links like this.' salla.sa did not appear in the host field at all, because it is not the site. The parameters table showed next with the value /pay once %2F was decoded.

Another trick: the familiar name at the start of the domain

Not every suspicious link uses @. We tried a link that starts, after https://, with salla.sa followed by a dot and another name, and the table showed the host as salla.sa.login-check.example in full. There is no warning here, but reading it correctly is easy: a domain is read from its end, working back from just before the first /, and here it ends in login-check.example. The familiar name is just a subdomain on someone else's site.

Steps

1. Long-press the link in the message and choose copy, not open.
2. Open the URL encoder/decoder, choose 'Decode' and paste the link.
3. Look at the 'Host' field in the parts table, and at any warning above it.
4. Read the parameters too: values such as next or redirect can carry a second link the visitor is sent on to.
5. If the host is not exactly the site you expect, do not open the link; go to the platform by typing its address yourself.

The limits of this check

• The tool tells you which host the text points to, but it does not check the site's reputation or whether it is safe.
• Shortened links show only the shortening service's host; the final destination is only known by opening them, and the tool never opens a link.
• Some letters from other scripts look like Latin ones. If the host shows a part starting with xn-- and you were not expecting a non-Latin domain, stop.

The same logic applies to QR codes: before you print one for customers, be sure of the link inside it. The QR code generator builds the code from the link you type yourself, so you know where it points.