check a suspicious link before you ever click it

that link in your texts is lying to you, probably

someone sends you a link. maybe it's "your package couldn't be delivered" or "unusual sign in detected" or your aunt's hacked facebook account sharing a "look at this video of you!!" post. your brain wants to click. don't. you can check where a link actually goes without ever loading it in a browser, and it takes about 30 seconds. here's how.

step 1: follow the redirects with curl

shortened links and phishing links almost never go straight to the final page. they bounce through two, three, sometimes five redirects to confuse spam filters and hide the real destination. you can trace that chain from your terminal without rendering a single pixel of the actual site.

curl -sIL "https://suspicious-link-here.com"

breaking that flag down:

-s means silent, so curl doesn't clutter your output with progress info.
-I means fetch headers only, no page content gets downloaded or rendered.
-L means follow redirects, so you see every hop in the chain, not just the first one.

you'll get a stack of http responses. look for the location: lines, that's the trail of breadcrumbs showing you every domain the link passes through before landing somewhere. if it starts at "yourbank-secure.com" and ends up at some random string on a domain you've never heard of, that's your answer right there.

step 2: check the domain's age with whois

once you know the real destination domain, check how old it is.

whois suspicious-domain.com

look for the creation date field. real companies, banks, shipping carriers, your actual employer, all have domains that are years, sometimes decades old. a domain registered 3 days ago pretending to be your bank's login page is about as subtle as a wig made of traffic cones. new domain plus urgent message equals run.

step 3: see where it's actually hosted with dig

dig tells you where a domain resolves, meaning what server infrastructure is actually behind it.

dig suspicious-domain.com

in the answer section you'll see the ip address it points to. you can take that ip and run it through a lookup service to see what hosting provider or country it belongs to. a "microsoft support" link resolving to a budget vps host in a country microsoft has zero offices in is a pretty strong tell. this won't catch everything, legit services use cloud hosting too, but combined with the domain age check it builds a much clearer picture.

step 4: still unsure? let a sandbox open it for you

if after all that you're still not sure, paste the link into urlscan.io instead of your browser. it opens the link inside an isolated sandbox, takes a screenshot of what loads, logs every request the page makes, and flags known malicious infrastructure. you get to see exactly what that link does without your own device or browser ever touching it. this is the move for links you genuinely cannot verify any other way.

the takeaway

none of this requires being a security expert. curl shows you the redirect chain, whois shows you how old the destination is, dig shows you where it actually lives, and urlscan.io lets something else take the hit if you're still not sure. real companies do not route you through three random domains to a site that was registered last tuesday. build the habit of checking before clicking, not after you've already typed your password into something fake. save this post, send it to whoever in your life clicks every link that lands in their inbox, and the next time something feels slightly off, trust that instinct and run the check instead of ignoring it.