A familiar logo can make a link look convincing before anyone reads its address. On a phone, a long URL may be shortened, a message preview may hide the destination and an HTTPS indicator may create more confidence than it should. These are reasons to check the address carefully, not proof that every unfamiliar link is fraudulent.
This WABO guide focuses on the web address itself: the hostname, the final destination and the limits of browser security indicators. It offers a practical reading routine for Malaysian readers without declaring a particular website safe, licensed or currently available.
Separate the label from the destination
The words displayed in a message are not necessarily the address that opens. A button can say “support” while linking somewhere unrelated. An image of a brand name is even less informative: it can be copied without giving the sender control over the real organisation.
Where the device provides a destination preview, inspect it without opening the link. If you cannot establish where it leads, use an independently located route to the organisation instead. Do not send passwords or verification codes to someone merely because their message includes a familiar picture or an account-related phrase.
Find the actual hostname
In a simple example such as https://support.example.com/help, the hostname is support.example.com. The later /help portion is a path. A brand-looking word in a path or an earlier label does not make the destination belong to that brand.
For illustration, https://example.com.account-check.test/help has a different hostname from example.com. The added words do not turn it into the original website. These are deliberately fictional examples, not addresses to visit. Real domain structures can be more complicated, so avoid reducing identity checks to a rule about counting a fixed number of dots.
HTTPS protects a connection, not a business promise
The Chromium explanation of its address-bar indicator makes an important distinction: connection encryption does not establish that the website is trustworthy. A fraudulent website can also use HTTPS. Browser interface icons can change, so do not rely on a padlock as the complete test.
In practice, ask two separate questions. Is the connection protected as expected, and have you independently established who controls the destination? A secure connection to the wrong organisation still connects you to the wrong organisation. Conversely, a familiar-looking page with a browser warning should not be made acceptable by ignoring the warning.
A redirect is a new destination to inspect
Websites can legitimately send visitors to a different address, but the fact that a redirect occurred does not explain why. Re-check the final address before entering information, particularly when the destination differs from the one you expected to use.
Imagine following a bookmark and finding that the page now presents a different hostname and an urgent request to verify an account. Do not assume the bookmark authenticates everything that follows it. Pause and compare the change with independently obtained information. If the situation cannot be explained, stop rather than repeatedly testing unfamiliar login pages.
Urgency can be more revealing than polished design
The UK National Cyber Security Centre’s phishing guidance describes pressure, claims of authority and emotional prompts as warning signs. Good spelling and an attractive layout do not remove those concerns. A demand to act immediately should not prevent a separate identity check.
For example, a message saying an account will close in minutes may try to stop you using an established contact route. Read what is being requested as well as who appears to be asking. A page can look routine while requesting information that the organisation would not normally need through that channel.
Keep a useful record without exposing secrets
If you need to ask about an unexpected address, note the time, visible hostname, how you reached it and the action requested. A screenshot can help explain the issue, but first remove passwords, one-time codes, account identifiers and unrelated personal information.
Do not publish a full link if it contains personal query parameters or access tokens. A description of the hostname and sequence may be enough for an initial enquiry. If you already disclosed sensitive information, use the affected service’s independently obtained recovery guidance promptly; this article does not replace incident-specific support.
Frequently asked questions
Does HTTPS prove that a page belongs to WABO?
No. Encryption and brand ownership are separate checks.
Does a logo authenticate a message?
No. Images and display names can be copied. Examine the destination and verify the sender independently.
Is every redirect suspicious?
No. Redirects have legitimate uses, but an unexpected final destination needs its own check.
Should I open a suspicious link to investigate it?
Do not open an uncertain destination merely to see what happens. Use independently located information and official reporting guidance instead.
The aim is a repeatable pause before sharing information. Read the actual address, question unexpected changes and keep the claimed identity separate from the quality of the design. No single icon, familiar word or screenshot can settle all three questions.
Brand information: WABO.