Tech Tip: Checking Questionable Links Without Clicking Them

There’s nothing that can set off a feeling of unease in a person more than wondering whether the link you just clicked on a website or in an email is going to load malware onto your Mac or direct you to a malicious page. In today’s tech tip, we’ll show you some ways to check those links that are making you feel queasy without clicking on them.

Why Can’t I Just Click On Every Link I See On Websites or in Emails?
You can, but you’re taking a risk doing so. First, let’s say you get an email that appears to be from your bank, asking you to log in and verify some account information. Don’t do it!

This is most likely a phishing attack, where a malicious party is attempting to direct you to a website that very often looks nearly identical to the one you wanted to visit. You log in…and that party now has your user ID and password, and in many cases can just log in and clear out your accounts. In other cases, you may be directed to a site where malware will be installed surreptitiously on your Mac without you knowing.

Think before you click, unless you’re absolutely sure that you’re on a safe site. What are some warning signs of malware or phishing links that you should look for?

Watch Out For Shortened Links
If you’ve been around the Internet for any length of time, you’re familiar with link shortening services like Bitly and TinyUrl. They take a long web address like “https://eshop.macsales.com/blog/42686-a-complete-guide-to-universal-clipboard-in-macos-high-sierra” and shorten it to something like “http://bit.ly/2zTnIoT”. This used to be quite handy in the days when every character in a web address counted against the 140-character limit on Twitter, and now it’s a favorite of hackers since that “bit.ly” domain name can mask a malicious URL that’s masquerading as the site of a financial institution.

How can you tell where a shortened link is trying to point you? There are two handy ways: First, use a link expansion service like CheckShortURL.com. Paste in the short URL and it will display a page of information about the destination (see screenshot below). There are even a set of links that will further check if your link is safe.

Beware of Phishing Emails
Getting an unsolicited email from your bank or another financial institution that’s asking you to verify information should set off warning bells in your head, as it’s probably a phishing attack. Oddly enough, I received a phishing email yesterday (see screenshot below) that’s perfect for demonstrating the elements of a phishing attack:

The emails will usually warn you of dire consequences if you do not respond to the email by logging into the service. In this case, it’s Stripe, which I use to receive payments for my business, and they’re trying to get my attention by telling me that I’m about to get a payment of $4600 and should check it out.

This is actually a pretty well-done phishing attack since a) I do have a Stripe account,  b) it’s not full of the grammatical and spelling error usually found in phishing emails, and c) it was a nicely done HTML email with a border, the Stripe logo, and even the correct address for Stripe. It set off the alarms in my brain because I never get payments that large through Stripe.

Fortunately there are a few ways to check out phishing emails without clicking any of the links contained in them. It’s possible to check the source of the email in macOS by hovering your cursor over the From address, then clicking the disclosure triangle ( ˇ ) that appears next to it. The screenshot below shows that the email address this was sent from was “strp33@sealcoatingandmore.com”, not an address at stripe.com.

That same disclosure triangle appears in other places when the cursor is placed above a link. For example, I hovered my cursor above the payment amount — which is a link — and clicked the disclosure triangle to show a preview of the web page (see screenshot below). Sure enough, it looks just like the Stripe login page, but it shows an “hippls.com” domain name at the top (outlined in red). That’s my second indication that this isn’t a valid email.

The disclosure triangle in macOS works well on the “View in Stripe Dashboard” link, too. Just hovering over the address shows a link to a “1stripe.com” domain, which is close, but still bogus… (see screenshot below)

Many browsers including Safari also display a warning if a site is dangerous. For example, a click on the “support website” link displays a bright red web page in Safari with the following message (see screenshot below):

All of these methods are for macOS, but what about iOS? Fortunately, you can do similar things to check out a potential phishing email on your iPhone or iPad.

For example, tapping on the From address (“Stripe Support”) in the phishing email used as an example here brings up a Contact sheet, which promptly shows the fake email address (see screenshot below):

Tapping and holding on any of the links in the email displays a menu of possible ways to process the link (see screenshot below), but the most important thing to note is the link address shown at the top of the menu (outlined in red). Once again, this is the faux “1stripe.com” website, not the real Stripe website.

Set Up Two-Factor Authentication
Even if you fall prey to a phishing attack like this one, there’s a way to ensure that the bad guys aren’t going to get into your account: set up two-factor authentication at your financial institutions. This usually works by sending an authentication code to something only you have — an email address or an iPhone — that you then enter into a field on the website for verification.

If the hackers don’t have your iPhone or Mac at hand, there’s no way they’re going to be able to receive that code and enter it into the website. This is the beauty of two-factor authentication – even if they have been successful in getting your user name and password, there’s no way they can log into the site.

Watch For Strange Characters in Links
Hackers and malware distributors often try to conceal the destination of their malicious websites by using URL encoding. In URL encoding, the letters and symbols that make up the website name are encoded as a percent sign ( % ) followed by a number. For example, MacSales.com might be encoded as %6D%61%63%73%61%6C%65%73%2E%63%6F%6D (an encoding table can be found here).

Long story short? Watch out for long URLs full of “%” symbols and avoid them at all cost.

Check a Suspicious URL with a Link Scanner
Finally, there are ways to test those web addresses that may look “OK”, but are still making you feel uneasy. Enter the web address into a known link scanner and see if it’s a valid address. Three sites that work well are Norton SafeWeb, URLVoid, and ScanURL. Enter an address into one of these sites, and they will provide a rating or response.

If the site shows up as “unknown”, with a “red” rating, or with a response of “URL is not valid”, you know you’ve got a live one.

Use Antimalware Software That Has Real-Time or Active Scanning Available
Let’s say you accidentally click a link that sends you to a site that’s set up to unload some malware onto your Mac. If you’re running antimalware and/or antivirus software on your Mac, make sure that it has a “real-time” or “active” scanning option and that it’s turned on. This will protect you from malware that may try to load itself onto your Mac if you hit one of these bad sites. Of course, you should make sure that your antimalware/antivirus software is updated frequently with virus definitions and engine updates.

Stay safe out there, please! Be sure not to click on any links in emails or on websites unless you’re absolutely certain they’re from a reliable source. Watch for misspellings and bad grammar on linked web pages and in emails, and set up two-level authentication when you want an extra level of safety.

Other Topics You Might Like:

Tech Tip: Sorting Notes in macOS and iOS Tech Tip: Disabling Safari Suggestions on macOS and iOS An Annual Reminder: Watch Out For ‘Phishing’ Scams Rocket Yard Guide: How Two-Factor Authentication for Apple ID Works