When a link says one site but opens another

How to read this alert

Treat this as a signal to slow down and verify the destination, the request, and the audience. The alert does not mean every related page is malicious. It means there is enough risk that the normal click-through habit is not good enough.

The safest response is to separate the message from the account, service, or person it claims to represent. Open the real service from a bookmark, typed address, password manager, or trusted app instead of letting the suspicious page choose the path for you.

What to check before you trust it

• The text says one organization, but the actual link opens another domain.
• The link uses a redirector, tracking URL, or shortened URL that hides the final destination.
• The visible text is a familiar brand, but the destination is a file host or unknown site.
• The destination asks for sign-in after a redirect.

Decision path

Examples

What to do next

1. Hover, long-press, or use your browser's link preview before opening.
2. Compare the actual domain to the organization named on the page.
3. Avoid entering credentials after redirects unless you intentionally navigated there.
4. If the mismatch came from an internal document, ask the sender to confirm through another channel.

Common mistakes

• Reading only the blue text instead of checking where it actually goes.
• Assuming every marketing redirect is safe.
• Following a link because the sender appears internal.