Steps to check potential phising links

[lobcmt2]

The topic aims at newbies, but it might be useful for older users, who spend little time in the forum, to discover, and to learn.
Phising links are one of the most terrible things that make-money-online guys have to face with.
I am not sure, but I guess that there is no stupid phisers will put their phising links directly, instead they tend to hide them inside url link.

I give you an example, in which I presents three ways to post link to the topic you are reading.

1) Hidden link
Steps to check potential phising links

2) Direct link
https://bitcointalk.org/index.php?topic=5130231.0
Phisers never post their phising links that way because no one is stupid and lazy too much to fall into their opened traps like this (very limited people will fall into such bad trap).

3) Shortened links
Example:

Code:

https://bit.ly/2Vzd1C9

I posted the link with code because I don't want you to unintentionally click on the link. Please don't click on the link or any link like this.


SOLUTIONS
So, how to check that links are potential phising links or not?
It is very easy, what you have to do is only four steps:

1) Don't hurry too much, don't lazy too much to immediately click on the topic or article links, whichever links hidden via url links.
If you find something interesting with their posts, and have intention to get more information they shared with hidden links, it's good to stop at this step, and move to the second step.

2) Clicking on the quote button to see which are hidden links or shortened links
If you find that the links inside url are familiar, it is safely to move next to read and get information.
If you find that the links inside url are un-familiar, it is better to stop at this, and do next steps.
For example:
If you click on the quote button to quote my OP, you will see hidden link like this:

Code:

[url=https://bitcointalk.org/index.php?topic=5130231.0]Steps to check potential phising links[/url]

And, the link is safe, because it leads to official bitcointalk.org forum, right?

Another way to check is hovering on the link, the you will see the link behind.
For example:
1. The image show the link hidden in the topic titles posted by DdmrDdmr, you can see the link in the left corner at the bottom of your browser by hovering your mouse on the topic title. It is easy, isn't it?

2. In the second example, I create a hidden link behind the phrase Bitcointalk Forum, that will lead you to a fake bitcointalk site. Please remember it will lead to a fake bitcointalk site, so please don't log in your bitcointalk account on that site. Your account might be hacked. I don't advertise for fake site here. It's just an example and it is another way to help you know about one of fake bitcointalk sites.
Bitcointalk Forum
If you really click on the link, it will lead you to the fake forum

It will become worse if you click on link that lead you to more dangerous sites, so please don't click on suspicious links.
Instead, one again, please hover your mouse on the suspicious link, then you will see hidden link behind. Like this:

You can see the link will lead you to bitcointalk[dot]com (that is fake/ scam forum).


3) Searching with the potential phising sites/ links with key words including their names + phising links/ phising sites.
Next, if the link you see after quoting or hovering looks risky, strange, you should do more search on those sites' reputation.
Key words should be used are:
- phising
- scam
- fake
- site name/ domain name

Another way is to check suspicious link with tools (I don't know about them well, so appreciate if someone can help).
whotookmycrypto suggested a site to check suspicious links, but someone else said even that site is not safe. So, please decide using it or not with your own interest.

4) Disable phising links found on your computer
After links determined as phising links, you should do the last step.

Another one to be added to your hosts files then.

On Windows, navigate to "C:\Windows\System32\Drivers\etc\", and open the hosts file in a text editor.
On Mac, navigate to "/private/etc/", and open the hosts file in a text editor.
On Linux, open terminal and write "sudo nano /etc/hosts"

Add the following two lines to the bottom of the hosts file:

Code:

0.0.0.0 bitcointalk.to
0.0.0.0 fonstavka.com

Your browser will now be unable to open those two phishing sites.

SHOULD READ:

What with bitcointalk .COM, it's a bit misleading.
[GUIDE] Use this for identifying Scam/Phishing/ Websites & Exchanges in Crypto

Other tips contributed by participants in the topic:

For most famous redirect website, you can just add a "+" (plus symbol) at the end of the URL and you'll go to a page where it shows everything about the redirection link (the final destination, clicks, stats, etc...).

Example:
https://bit.ly/2Vzd1C9+

CONTRIBUTORS
I appreciate to all contributors whom help me to make the topic better.
whotookmycrypto
DdmrDdmr
r1a2y3m4
TryNinja
GreatArkansas

[1714525978]

1714525978

[whotookmycrypto]

Scammers also commonly use URL shorteners to mask their links. Examples include bitly and rebrandly.

Example of a shortened link: https://bit.ly/2Vzd1C9

Instead of clicking the link to check out where it leads, throw the link into websites like http://redirectdetective.com.

This is what would appear:

[lobcmt2]

Thanks, that is why I say we should click on the quote button to see which links hidden behind, then your steps recommended above are great. To be honest, I did not know about that, before you shared it above. 

[whotookmycrypto]

Thanks, that is why I say we should click on the quote button to see which links hidden behind, then your steps recommended above are great. To be honest, I did not know about that, before you shared it above. 

Great share mate. We are all learning. Didn't know some of the stuff you mentioned in your post too so thanks for the share.

[lobcmt2]

You know what, I just saw this one a seconds ago:
What with bitcointalk .COM, it's a bit misleading.

[whotookmycrypto]

Yeah these things pop up all the time so need to be careful. Another example that appeared a short while ago:

https://bitcointalk.org/index.php?topic=5122733.0

[jossiel]

Scammers also commonly use URL shorteners to mask their links. Examples include bitly and rebrandly.

Example of a shortened link: https://bit.ly/2Vzd1C9

Instead of clicking the link to check out where it leads, throw the link into websites like http://redirectdetective.com.

This is what would appear:
[img ]https://i.imgur.com/3fkNLLl.png[/img]

Hey, I've been looking for a site like this. Thank you for sharing this site, this is really helpful. Phishers do really use link shortners to hide the real link they are sharing.

They will add some interesting captions and statements relative tovthe topic and at end they'll put that link.

[DdmrDdmr]

<…>

One thing to bear in mind is that you cannot quote a post to see the link if you are not logged-in into the Forum. People seem to often browse without loggin-in (see last charts on [Chart] Bitcointalk statistics on impression counts for ads). Nevertheless, whether you are logged-in or not, you can always hover over the hidden link on the forum, and see the linked URL displayed on the bottom left side of your screen.

[lobcmt2]

You shared great tip, DdmrDdmr, I tried hovering over hidden link, and saw what you meant. Thanks.

[jademaxsuy]

Well there are many phishing links here, in telegram or from social media being posted just to compromise user's account and they can even do it for some  users are notnjust careful with their account, wallet.or etc. As long they think that it was the right website.

Most users that can do mistake without checking the links are not that techie when it comes to the technical aspect of the system.

[whotookmycrypto]

Hey, I've been looking for a site like this. Thank you for sharing this site, this is really helpful. Phishers do really use link shortners to hide the real link they are sharing.

They will add some interesting captions and statements relative tovthe topic and at end they'll put that link.

No problem. If someone can point to a browser extension (firefox / chrome) that allows users to hover over a link and receive the eventual website address, do share on this forum. Would send merit your way.  Haven't been able to find a plugin with that functionality, the rest all require copying and pasting of addresses which is a hassle.

[r1a2y3m4]

I just want to add an information to check if the link is a phishing link. One way to avoid that is to hover. When we say hover it is when you put your mouse over a file or a link and you can see the link to that file. Here's an example to it.

You can see the blue arrow, I hovered at bitcoin forum. And the link was showed at the lower left part(where the red arrow is pointing).

Please don't click what's below this, I only used this as an example.

Hover to this -> twitter.com. As you can see, the in human's eye is twitter.com but if you click it it will redirect you to another page(facebook.com). So, you need to hover on every file that you are suspecting.

[Baofeng]

One thing I don't like about http://redirectdetective[dot]com is that it's not even secure,  

[r1s2g3]

Please don't click what's below this, I only used this as an example.

Hover to this -> twitter.com. As you can see, the in human's eye is twitter.com but if you click it it will redirect you to another page(facebook.com). So, you need to hover on every file that you are suspecting.

I guess, I know about that but it slipped from my mind.  I was wondering the same after reading OP that how I will check links that are not posted in this forum.

One thing I don't like about http://redirectdetective[dot]com is that it's not even secure, 

Still it look better option that going directly to the url shortened link.

[Theb]

For people recommending on hovering on the potential phishing links, this will only work if the url itself is directly linked to the text. But for URL shorteners this trick won't work as they would only show you the url for the shortned website not the website link itself (try hovering on the shortened link posted by whotookmycrypto in the thread). So if you know that you are on a sketchy website or a strange person have given you a URL shortened link then you must be very cautious on looking at the various red flags seen on a phishing website because I myself personally won't even bite and click the link, I would rather search the official website instead in Google just to be safe.

[khaled0111]

...

There are many online tools that can be used to retrieve the target URL. All you have to do is to copy paste the shortened URL and you will get the original one.
Baofeng justr stated one of them which is redirectdetective.com and here is another one checkshorturl.com

[lobcmt2]

There are many online tools that can be used to retrieve the target URL. All you have to do is to copy paste the shortened URL and you will get the original one.
Baofeng justr stated one of them which is redirectdetective.com and here is another one checkshorturl.com

In a summary, I got two potential sites for use:

Code:

redirectdetective.com
checkshorturl.com

Not sure why Baofeng stated the site does not really secure. Did you get opinion of Baofeng?

One thing I don't like about http://redirectdetective[dot]com is that it's not even secure,  

[khaled0111]

...
Not sure why Baofeng stated the site does not really secure. Did you get opinion of Baofeng?

One thing I don't like about http://redirectdetective[dot]com is that it's not even secure,  

I think because he is using http instead of https (BTW it was whotookmycrypto who mentioned it not Baofeng, sorry for that) 
There is nothing to fear, I just used virustotal to scan it and the result was 100% clean

[TryNinja]

For most famous redirect website, you can just add a "+" (plus symbol) at the end of the URL and you'll go to a page where it shows everything about the redirection link (the final destination, clicks, stats, etc...).

Example:
https://bit.ly/2Vzd1C9+

[jossiel]

Hey, I've been looking for a site like this. Thank you for sharing this site, this is really helpful. Phishers do really use link shortners to hide the real link they are sharing.

They will add some interesting captions and statements relative tovthe topic and at end they'll put that link.

No problem. If someone can point to a browser extension (firefox / chrome) that allows users to hover over a link and receive the eventual website address, do share on this forum. Would send merit your way.  Haven't been able to find a plugin with that functionality, the rest all require copying and pasting of addresses which is a hassle.

Will do, if I've found an extension that this kind of function, I'll notify everyone here quickly. I understand what you are trying to convey and I felt that, we have to check it like the tutorial you have given and it consumes time.

Unlike hovering it to the link, you can already check what's the true link behind that shortener.