Reading a URL Like a Security Reviewer
Most phishing links do not look obviously fake. They bury the real domain under subdomains, stretch the URL so the important part scrolls off screen, or swap in a lookalike domain with a different top-level domain. The anatomy view fights that by splitting the URL into its structural parts: the scheme, the host, the registrable domain, the subdomain chain, the path, and every query parameter. Read the registrable domain first — that is who actually owns the site.
The registrable domain is the truth
In shop.example.co.uk, the registrable domain is example.co.uk; shop is just a subdomain. In secure-login.example.com.evil.example, the registrable domain is evil.example and everything before it is decoration. Attackers rely on readers stopping at the first familiar word. Always read the domain from the right, and compare the registrable domain against the brand on the sign.
Anatomy signals that deserve a second look
- HTTP instead of HTTPS: the connection is not encrypted.
- An IP address as the host: legitimate public sites rarely link to bare IPs.
- Punycode (xn--) in the host: the domain may contain lookalike Unicode characters.
- A deep subdomain chain burying the real domain.
- Embedded credentials (user:pass@host) — a classic disguise.
- A long tail of query parameters carrying tracking IDs or personal data.
None of these alone proves a link is malicious, and a clean anatomy does not prove it is safe. Anatomy tells you where to look; the destination page itself still needs a check before you sign in or pay.