A message can display a familiar company name while its link points somewhere else. You do not have to open the link to make a cautious first assessment: inspect the destination, identify the actual domain, and compare it with the site you expected. That can help reveal obvious mismatches, but it cannot prove a link is safe. If a message asks you to sign in, change account details, or take another sensitive action, the safer route is to open the service independently rather than follow the message’s link.
The useful bits
- Preview the destination without opening it, then read the domain from right to left.
- Treat shortened, obscured, or unexpected destinations as reasons to pause.
- Reach sign-in and account pages through a trusted route you enter yourself.
Reveal the destination without opening it
On a computer, move the pointer over the link without selecting it. Many email or browser interfaces show the destination in a status area or preview. Check that the preview belongs to the link you are inspecting, especially if the message contains several links. Do not click just to see where it goes.
On a phone or tablet, the available preview depends on the app. If a press-and-hold gesture displays a destination before opening anything, read it there; stop if the gesture starts navigation or the preview is unclear. Another option, where available, is to use a context option to copy the link address and paste it into a plain-text note for inspection. Do not paste an unknown address into the browser to test it.
Find the site’s actual domain
Read the web address from the start and identify the hostname after the protocol, such as https://. The hostname ends at the next slash, question mark, or other separator. Within it, focus on the main domain near the end: in account.example.com, the main domain is example.com. The word “account” is only a subdomain.
Compare that domain with the one you already know or would expect for the organization. Do not be reassured just because a brand name appears somewhere in a long address. For instance, example.com.attacker.invalid belongs to attacker.invalid, not example.com. Extra words, swapped letters, unusual spellings, and lookalike characters are reasons to pause.
Message says: “Review your Example account.” Displayed text: “Sign in to Example” Previewed destination: https://example.com.attacker.invalid/session What to notice: The main domain is attacker.invalid, so this is not the example.com site.
Treat shortened and unexpected links carefully
A shortened address hides the destination until it redirects, so its visible text gives you little basis for comparison. Do not follow it merely because it appears in a familiar message. If the sender can provide the full destination or explain why the short link is necessary, verify that through a separate, trusted channel.
An unexpected link deserves caution even when its domain looks plausible. Ask whether you were expecting this message and whether the request makes sense in context. A familiar display name, logo, or email signature is not enough to establish who sent it. If you cannot confirm the destination or the reason for the request, leave the link unopened.
Handle sign-in and account requests independently
For a sign-in, password change, payment, recovery, or other account action, open the service using a bookmark you created earlier or type its known address yourself. Then find the relevant account area from within that service. This avoids relying on the message to direct you to the right destination.
For BITTU Mail, the public website is https://bittumail.tech, while sign-in, registration, account recovery, and account actions go through https://mail.bittuicloud.com. If an unexpected message asks you to sign in or change account details, navigate to the appropriate address independently instead of using its link. Do not enter a password or one-time code on a page reached through a suspicious message.
A quick check before you act
Use this short checklist when a link is unfamiliar or connected to an account request:
- Preview the destination without opening it.
- Identify the main domain, not just the brand name or subdomain.
- Pause if the address is shortened, misspelled, obscured, or unexpected.
- For sensitive actions, navigate independently and locate the request there.
- If anything remains unclear, do not use the link; verify the request through a trusted route.
Confirm your choice—and keep the limits in mind
You can confirm that you handled the check cautiously by ensuring you did not open the questionable link, and, for an account action, that you reached the service through a route you selected independently. If the service shows no corresponding request after you navigate there, do not return to the message link to investigate.
A visible address is only one clue. A convincing-looking domain does not establish that a page is safe, and a destination preview may not reveal everything that happens after navigation. Inspection can catch some mismatches, but it is not a guarantee. When you cannot confidently verify the destination and the reason for the link, the cautious choice is not to follow it.
About this guide
Prepared with AI assistance for the BITTU Mail editorial library. Check important details against your original messages and current account settings. Product access depends on your role, plan and provisioning state. Provider interfaces and requirements can change.
View current plans · Security information · Suggest a correction