Don't Let a Familiar Link Fool You
Think a link is safe because it starts with Google or Bing? Think again. Cybercriminals can hide malicious websites behind trusted-looking links. Learn how to spot these tricks and verify where a link really takes you before clicking.
A link can look trusted and still be a trick.
Cybercriminals know that people are more likely to trust links that appear to come from familiar websites. One tactic attackers use is hiding a malicious website behind a link that starts with a trusted domain, such as Google or Bing.
A link may look safe at first glance, but the actual destination could be somewhere completely different.
Example: Look Beyond the Beginning of the Link
You receive a link that looks like this:
https://www.google.com/url?q=https://login.example
It may appear to be a Google link, but the real destination is:
https://login.example
The website listed after “q=” is where the link will actually take you.
Attackers use this technique to make phishing emails appear more legitimate and trick users into entering usernames, passwords, or MFA codes on fake login pages.
How to Stay Safe
Before clicking a link:
- Don’t trust a link just because it starts with Google or Bing. Check where it actually leads.
- Hover over links before clicking to preview the true destination.
- Be cautious when asked to sign in unexpectedly. Stop and verify the website first.
- When in doubt, go directly to the website. Type the address into your browser instead of using the link.
Remember: Verify Before You Sign In
Always check where a link is taking you before entering your NetID password or approving a Duo verification request.
If a link looks suspicious or something doesn’t feel right, report it using the Phish Alert Button (PAB). Reporting suspicious messages helps protect the entire campus community.
Want to Learn More?
Google Safety Center | Tips and tools to help you stay safer online
Google | Safe Browsing site status
CISA | Secure Your World
- Published
- Type
- Topic
