How to safely investigate a suspicious redirect

A page offering only “Click here to proceed” and no business name, product, contact details or explanation should be treated as an unknown signpost, not automatically as fraud. A redirect can lead to a genuine offer, a tracking gateway, a compromised account, a fake sign-in page or a scam. Investigate without engaging with the destination, because clicking can activate tracking or expose your details.

A safe investigation of a suspicious redirect starts by separating what you know from what you infer. The wording does not reveal the true destination, and familiar branding can still be misleading. Work from the original message, preserve what is visible, inspect the underlying hyperlink without opening it, and confirm independently through official channels. If someone you know sent it, contact them using details you already have rather than replying to the suspicious message.

Recognise the warning signs

Generic prompts deserve caution because they demand a click before explaining the purpose. A button saying “Claim your refund” may lead somewhere unrelated. Check whether the page identifies the sender, location, price, terms and Australian business details. A missing ABN, trading name or responsible contact matters most when money or identity documents are requested.

Red flags often appear in channels Australians already use: Facebook Marketplace or Gumtree Australia, an Australia Post delivery notice, a bank-security text, a social-media prize draw or a Centrelink-themed email. Local phrases such as “your parcel is waiting” or “your account will be suspended” are easy to copy. Familiar language and an Australian logo establish context, not legitimacy.

Compare the visible link with the claimed sender and expected destination. If one organisation appears in the text while the underlying target leads elsewhere, stop. A destination such as an unrelated destination cannot be judged from its URL alone; the issue is why a trusted message points there without explanation. Urgency, unusual payment methods and a small “verification” fee add risk.

Inspect the link without opening it

On a desktop, hover to preview the status-bar address and right-click the link to copy it without following it. Do not middle-click, scan an unknown QR code or paste the URL into a random checker. On a phone, press and hold the hyperlink or use Copy Link in the messaging app. Menus differ between iPhone and Android, but the goal is to obtain the full address without opening it.

Read the address from right to left and identify the registrable domain. In service.com.au.account-check.example, the apparent organisation is only service.com.au; the final domain is example. Australian organisations often use .com.au, .org.au or .asn.au, but every extension can be abused, and a country-code domain does not prove a connection to that country.

If the address is shortened, use a preview supplied by the messaging platform or a reputable expander rather than opening it, while remembering that the expander’s operator will receive the URL. Look for swapped letters, repeated characters and Unicode lookalikes. To check a business, enter its known site manually and find support details there. A domain launch checklist can expose missing identity or legal pages, although those omissions alone do not prove malice.

Trace the destination without triggering it

Search the exact domain in quotes, the claimed company with “scam” or “phishing”, and unusual wording from the message. Search results can contain scam clones, so open official sites independently and compare details. A domain registered days before the message deserves extra caution, but age is not proof: legitimate campaigns also launch new domains, while old domains can be compromised.

Domain and certificate checks add context, not a verdict. Use ICANN Lookup or the relevant registry for creation dates, name servers and changes; Australian .au records can be checked through auDA’s WHOIS service. A padlock means the connection is encrypted. It does not identify the owner, remove phishing or show where the redirect will end.

Google Safe Browsing and VirusTotal can reveal prior detections and sometimes a redirect chain. Queries are visible to those services, so never submit URLs containing client tokens, patient identifiers or internal hostnames. Some scanners make live requests. Use public, non-sensitive links only, and treat “not found” as no detection yet. A discussion of possible marketing experiments also shows how legitimate brands may vary landing pages, a technique cloned campaigns can imitate.

Understand how redirect domains work

Redirects have ordinary jobs: shortening social posts, campaign tracking, affiliate links, language routing and moving an old address. A redirect is not automatically hostile. The hidden redirect behaviour shows how intermediate hosts can conceal a mismatch or pass visitors through several domains. Risk depends on the final destination and whether the sender disclosed the route.

Some redirect URLs have no visible homepage, only a path that triggers a campaign or login flow. Practical siteless uses describe legitimate reasons for that design, so a blank homepage is not decisive. In a suspicious chain, a blank page, cloned sign-in form and urgent request for credentials form a worrying combination. Never enter a password merely because a redirect demands it.

Compare the final destination with the organisation named in the original message. If the first stage requests personal information before explaining the offer, close it. A disclosed tracking domain, an expected final site and a clear privacy notice can indicate legitimate campaign measurement. An undisclosed chain that crosses unrelated brands or asks for one-factor codes deserves suspicion.

Contain harm after a click

If you already clicked, panic is rarely useful. Modern browsers isolate ordinary web pages, and a visit alone does not mean infection. Close the tab, decline requests to open an application or download a file, check Downloads and browser notifications, and remove anything you did not knowingly install. Run the security scan built into your operating system or browser.

Respond to what happened next. If you entered a password, change it from a trusted device, sign out other sessions, reset multi-factor authentication and check for changed recovery details. If you supplied card details, contact the institution through its official app or the number on the back of the card. Australian banks can freeze cards and investigate transfers quickly, but early reporting is essential.

If the page requested identity documents, contact the relevant service directly and consider what was exposed. Update the operating system and browser, run reputable anti-malware software, and watch for delayed fraudulent transactions. A phone number in an SMS may route to a call centre rather than the named business, so independently verify an Australian company through its official .com.au or government website.

Keep a practical response checklist

If you followed the link, act in this order:

• Close the page and any tabs opened from it.
• Check Downloads, notifications and installed extensions.
• Change credentials and revoke sessions only if information was entered.
• Contact your bank or card issuer through verified contact details.

If you did not click, preserve a clean record:

• Screenshot the original message, page and visible address.
• Note the date, time, sender and how you received it.
• Save the full hyperlink and any redirect-chain details.
• Keep the original email headers or text message.

Report the message without forwarding live payment details. ACCC’s Scamwatch offers guidance and accepts reports; SMS phishing can be forwarded to its 7729 service. Use Report Cyber for cybercrime, eSafety for harmful online content, and the relevant regulator for fake medicines or listings. If the message came from a compromised friend’s account, tell them through another channel and ask the platform to preserve the message.