Phishing is one of the most effective and oldest tricks in the cybercriminal arsenal. It relies on social engineering and deception. Even though attacks happen on a massive scale, a small number of victims is enough for attackers to gain significant benefit. As technology advances, so do cybersecurity measures — but attacks also become more complex. One increasingly common tactic is URL masking, which makes it harder for both users and security tools to recognize malicious links.
Phishing via links
Despite the rise of phishing through SMS (“smishing”), QR codes (“quishing”), and social media, email remains the leading attack vector. According to data, 58% of phishing emails contain malicious links, while an additional 24% rely on attachments.
Phishing links are used for various purposes, including:
- Fake sites imitating banks, email services (e.g., Gmail, Outlook), or payment platforms
- Financial transaction fraud
- Collecting personal data (name, ID number, address)
- Distributing malware
What is URL masking?
Legitimate organizations use shortened URLs for easier content sharing. However, cybercriminals adopt the same technique to hide the true destination of their malicious links. A masked link may look legitimate but redirects users through multiple layers to a fake phishing site. Attackers even use techniques like XSS vulnerabilities to conceal the real target.
It’s important to understand that masked links are often not just deceptive — they are malicious. Their purpose isn’t only to fool users but to lead them to fake sites, install malware, or steal sensitive data without the user’s knowledge.
How to spot masked or fake links?
Regardless of technical expertise, every user can recognize potentially dangerous links by knowing what to watch for:
- Read the entire address carefully: Attackers often use variations of known addresses:
paypal.com vs. paypa1.com (replacing letter “l” with number “1”) - Check the domain (main part of the address): Safe links have a clear, short, and recognizable main domain. Everything before the dot should be the organization’s name, not an addition.
- Hover over the link: On a computer, before clicking, hover the cursor over the link and check the address shown in the browser’s bottom-left corner. On mobile, long-press the link (without releasing) to see the destination.
- Don’t rely solely on the padlock (HTTPS): Phishing sites can have valid SSL certificates. The padlock means the connection is encrypted — not necessarily safe.
- Use link checking tools like:
- Virustotal.com — for analyzing links and files
- Urlscan.io — to detect redirects and potentially malicious elements
- Avoid impulsive clicks: If someone urges you to “act urgently,” “claim a prize,” or “save your account” by clicking — there’s a high chance it’s phishing.
According to studies, 52% of phishing attacks use redirection through legitimate services, and research by Abnormal Threat Labs shows a 350% increase in phishing scams via fake file-sharing services in 2024, with small differences in scam effectiveness between email and mobile app users.
Detection and prevention
User and employee training:
✔️ Don’t rely solely on link appearance
✔️ Pay attention to:
- Unusual greetings (“Dear user”)
- Generic or alarming headlines: “Urgent!”, “Suspicious activity!”
- Spelling mistakes and unrealistic offers
Technical protection:
- AI/ML detection systems (e.g., sandbox analysis, link isolation)
- DMARC/SPF/DKIM settings for sender verification
Advanced filtering methods:
- Analyze the full link, not just the initial address
- Rescan links after initial validation
- Better-defined rules in email clients and browsers
- Over 90% of major cyberattacks start with phishing
- The average user takes only 21 seconds to click a malicious link and 28 seconds to enter data
URL masking is an example of how cybercriminals use the same technologies as legitimate organizations — but for deception. Therefore, it’s important to:
- Educate yourself and others on how masked links look
- Implement tools for checking and protection (both as individuals and organizations)
- Develop a habit of avoiding impulsive clicks — because one wrong click can have the wrong consequences.
