What is URL spoofing and how can I stop it?

When URL spoofing changes from suspicious to dangerous

An unfamiliar URL is not automatically malicious. A link needs more scrutiny when the message is unexpected, asks for credentials or payment, or directs the recipient to act under time pressure. The UK National Cyber Security Centre's phishing guidance advises people to avoid using contact details supplied in a suspicious message and instead use a known route to contact the organization.

Use this decision rule:

• If you did not expect the message, do not sign in through its link.
• If the message names a company you use, open that company's known app, bookmark, or manually entered address instead.
• If you need to inspect a link, identify the hostname before opening it and treat lookalike spelling, unfamiliar suffixes, and misleading subdomains as warning signs.
• If a link has already been opened, do not enter credentials. Report it through your organization's process and change passwords only through the legitimate service if credentials were submitted.
• If the same brand is repeatedly impersonated, investigate both the spoofed destination and whether attackers are also sending mail that claims to be from your domain.

A worked URL-reading example

Consider this illustrative URL:

https://microsoft-login.security-review.badsite.test/session?return=portal.example.com

The destination hostname is:

microsoft-login.security-review.badsite.test

The query parameter return=portal.example.com does not make the link go to portal.example.com. It is data supplied to the destination. Likewise, a familiar name at the beginning of a hostname does not establish ownership of the domain at the end.

Inspect the link in this order:

• Find the hostname, between https:// and the next /.
• Ignore the path and query string until you know who controls the hostname.
• Identify the domain registration boundary from the right, using your organization's approved browser, security tooling, or domain-review process.
• Compare it with the address you would normally use for that service.
• If the link is suspicious, do not use it to authenticate, download software, or provide information.

What stops URL spoofing in practice

Use controls that address the point where the risk appears.

For individual clicks, browsers and mailbox security products can warn on known unsafe destinations. Google Safe Browsing provides protections used across Google products and Chrome. Organizations using Microsoft 365 can review Microsoft Defender for Office 365 Safe Links documentation, which describes URL protection and time-of-click checks for supported workloads.

For account compromise, require MFA so a captured password is less likely to be enough for an attacker to access an account. For email impersonation, publish and enforce email authentication for domains your organization owns. The email authentication learning hub explains how SPF, DKIM, and DMARC work together.

DMARC has a clear boundary in this problem. It can help receivers identify mail that falsely claims to use a protected From domain when the message fails DMARC. It does not examine the destination URL, remove a link from a message, or prevent an attacker from registering and authenticating a lookalike domain. For the broader response process, see how to stop spoofing attacks and what spoofing is and how to stop it.

Do not change a DMARC policy in response to one suspicious link without first reviewing legitimate sending sources and their alignment. A policy change can disrupt real mail that is still failing DMARC.

Check a suspicious link before opening it

If you have an unexpected URL, inspect it with Palisade's phishing link checker before anyone uses it for a login or download. Compare the result with the full message context and your known contact route for the organization.

Check the suspicious link

A link check cannot prove that a site is safe, explain a mailbox provider's private filtering decision, or prevent a later change to the destination.

If the recurring problem is mail impersonating domains you manage, Palisade is agentic DMARC software that analyzes DMARC aggregate-report data, identifies sending sources and authentication or alignment issues, and creates prioritized remediation tickets. It can propose the next policy step when evidence supports it, while your team reviews the evidence and applies the DNS change. It does not block URLs, change a receiver's decision, or autonomously change your DMARC policy.

Start with Palisade