A link can look familiar and still lead somewhere unexpected. The sender's name, a recognizable logo and an HTTPS padlock are useful pieces of context, but none proves that the request is genuine. Safe link checking means combining destination evidence with independent verification of what the message asks you to do.
Start with the request
Ask why you received the link. Were you expecting a parcel, password reset or payment request? Does the message demand an immediate response or threaten account closure? Does it ask for a password, bank information or one-time code? These questions matter as much as the reputation of the destination.
Someone you know can forward an unverified message or lose control of their account. If a request is unusual, contact them through another established channel. For a banking or delivery claim, open the organization's genuine app or obtain its address independently. Do not rely on the support number inside the questionable message.
Read the hostname carefully
The visible link label can differ from the address it opens. In the illustrative address bank.example.attacker.test, familiar words at the beginning do not make the site a bank. The registrable domain belongs under attacker.test. This is an example, not a destination to visit.
HTTPS encrypts a connection; it does not certify the honesty of the operator. A shortened link conceals information you would otherwise inspect. If your app's copy/preview controls are unclear, avoid experimenting on an important device. Verify the claim through the official service instead.
Protect private URLs
Some links are credentials. Password resets, document invitations and account-verification URLs can contain tokens that grant access. Do not send their complete addresses to public scanners or paste them into a public report.
A hostname-only lookup can sometimes answer a narrower question without disclosing the token. Recognize its limit: domain reputation is not a verdict on a specific document or page. A legitimate hosting service can contain harmful user-created content, and a newly registered harmful domain may have little history.
Compare the available signals
Use Guardian for a voluntary URL check and read the sources behind the result. Provider outages, rate limits and cached observations affect coverage. A low-risk score should not overrule a suspicious request for credentials or money.
If the message itself needs interpretation, Guardian also supports message and screenshot-text checks. Review extracted text for OCR mistakes and remove passwords, account information and one-time codes before analysis. An AI explanation can help identify patterns; it does not authenticate the sender or prove an image is genuine.
For deeper evidence, use the investigation workspace to review available public observations and source dates. Threat Feeds provides another view of available phishing and malware indicators. Neither workspace has a complete view of every new threat.
Know what a clean result means
No detections means the checked sources did not provide a detection in that result. It is not a promise that the destination has never been harmful or cannot change. Likewise, a detection should be read in context: the exact URL, observation date, source, and reported behavior matter.
Avoid broad blocking based solely on shared infrastructure. An IP can host unrelated domains. If an analyst proposes blocking a shared address, consider potential service disruption and whether a more precise indicator is available.
If you already interacted
Clicking, downloading, running a file and entering credentials are different events. If you disclosed a password, change it through the real service and review active sessions. If financial access or a transfer is involved, contact the institution promptly through an official channel. If a file was downloaded, avoid running it and seek appropriate device-security support.
Keep relevant messages and timestamps as evidence. Do not forward a live suspicious link simply to warn everyone. For organizations in Africa and the Gulf, an agreed reporting route and a short verification checklist make the response easier than relying on each person to improvise.
Start with Guardian's link and message checks, then verify consequential requests independently. The goal is a better decision, not a reassuring badge.