Obfuscated Links Explained: Spotting Phishing URLs for the Security+ Exam

Obfuscated links are URLs deliberately disguised so the recipient cannot tell where they actually lead. They are a core phishing technique, and they work because people have been trained to "check the link before clicking" without being taught what part of a link actually matters.

Everything in a URL before the final domain can be faked. The only part that decides where you go is the registrable domain immediately left of the first single slash.

How Links Get Disguised

Mismatched display text. In HTML email, the visible text and the destination are separate. A link reading www.yourbank.com can point anywhere at all. This is the simplest technique and still the most effective.

Subdomain deception. yourbank.com.secure-login.ru is a subdomain of secure-login.ru, not of yourbank.com. Readers scanning left to right see the familiar name first and stop reading. Read a domain from the right, not the left.

Typosquatting and homoglyphs. arnazon.com with rn in place of m, or a Cyrillic character that renders identically to its Latin equivalent. These are registered domains that pass every authentication check because the attacker owns them.

URL shorteners. A shortened link discloses nothing about its destination. Many are legitimate; that is precisely the problem.

Percent encoding. Replacing characters with their hex equivalents so filters and humans do not recognize the string.

The @ trick. Anything before an @ in a URL is treated as user info and ignored by the browser, so https://www.yourbank.com@attacker.site/login goes to attacker.site. Modern browsers warn about this, but it still appears in phishing and in exam questions.

Open redirects. A legitimate site with a redirect parameter — https://trusted.com/out?url=attacker.site — sends the victim onward. The initial domain is genuine, which defeats both reputation filters and a careful reader.

QR codes, sometimes called quishing. A printed or emailed code hides the URL entirely, and it moves the click onto a phone, where the address bar is truncated and corporate filtering often does not apply.

Legitimate cloud hosting. A phishing page on a well-known file-sharing or site-builder service inherits that service's domain and reputation.

Reading a URL Properly

The skill worth teaching users, and worth knowing for the exam, is finding the registrable domain. Ignore the scheme, ignore any user info before an @, then read from the first single slash backwards: the last two labels before that slash are the domain that matters.

• https://secure.yourbank.com/login → yourbank.com. Legitimate.
• https://yourbank.com.login-secure.net/ → login-secure.net. Not legitimate.
• https://yourbank.com@evil.io/ → evil.io. Not legitimate.
• https://yourbank-com.security-check.org/ → security-check.org. Not legitimate.

One more point worth making plainly, because the misconception is widespread: HTTPS and a padlock prove nothing about honesty. Certificates are free and automated, and the large majority of phishing sites use them. The padlock means the connection is encrypted, not that the site is who you want it to be.

Defending Against Them

• Hover before clicking on a desktop, and long-press on mobile, to see the real destination. Then read it from the right.
• Type known addresses directly, or use a bookmark, for anything involving credentials or money. This defeats every technique above at once.
• Email gateway URL rewriting and time-of-click analysis, which re-checks the destination at the moment the user clicks rather than when the message arrived — important because attackers often weaponize a URL after delivery.
• DNS filtering to block known-malicious and newly registered domains.
• Lookalike domain monitoring for your own brand, with defensive registration of the obvious variants.
• Browser isolation for untrusted links in high-risk environments.
• External sender banners, so a message claiming to be internal is visibly not.
• Phishing-resistant MFA, which means a harvested password is not enough even if someone does click through.

Security+ (SY0-701) Exam Tips

• Recognize each technique by description: mismatched display text, subdomain deception, typosquatting, homoglyphs, shorteners, the @ trick, open redirects, QR codes.
• Read domains from the right. Expect a question presenting four URLs and asking which is legitimate.
• HTTPS does not mean safe. A very common distractor.
• Quishing is QR-code phishing, and it belongs with vishing and smishing in the channel family.
• Typosquatting, URL hijacking and homoglyph attacks are named techniques.
• The strongest user-side control is not clicking the link at all — navigate independently.
• Open redirects on your own site are a vulnerability, and unvalidated redirect parameters should be fixed.

CySA+ and PenTest+ Angles

CySA+ (CS0-004) covers the analysis: extracting and decoding URLs from a reported message, checking reputation and registration age, detonating safely in a sandbox, and searching proxy logs for other users who visited the same destination.

PenTest+ (PT0-003) covers the offensive use in authorized phishing assessments — lookalike domain registration, credential harvesting pages, and reporting the result as a training and control gap.

Key Takeaways

• Obfuscated links hide their true destination while appearing trustworthy.
• Read the domain from the right, starting at the first single slash.
• Subdomain deception is the most common trick — yourbank.com.evil.net belongs to evil.net.
• Anything before an @ is ignored by the browser.
• Open redirects abuse a genuine domain, which defeats reputation checks.
• HTTPS and a padlock say nothing about legitimacy.
• Navigating independently beats inspecting the link every time.