How to check a suspicious link or file
Free ways to look at a link or attachment before you trust it, including VirusTotal, URL expanders and Google's Safe Browsing status page, plus the privacy mistakes to avoid.
Start with the safest check
The safest way to deal with a suspicious link is not to click it at all. If a message claims to be from your bank, a delivery company or a coworker, go to the real website or app yourself, or contact the sender through a number or address you already know. Most phishing depends on you acting quickly on the link in front of you.
Online checkers are useful when you genuinely need to know whether a link or file is safe, for example a document from a new client or a shortened link in a group chat.
Checking links
URL expanders. Shortened links (bit.ly, tinyurl and similar) hide the real destination. Free expander sites such as CheckShortURL or Unshorten.it show where a link leads without visiting it. Many shorteners also offer a preview page: for bit.ly links you can add a plus sign to the end of the link to see the destination first.
Google Safe Browsing site status. Google's Transparency Report includes a free site status page where you can paste a web address and see whether Google currently flags it as dangerous. This is the same list that powers warnings in Chrome, Safari and Firefox.
VirusTotal URL scan. VirusTotal, owned by Google, checks a link against dozens of security vendors' blocklists at once and shows how many flag it.
A clean result does not prove a link is safe. Brand-new scam sites often have not been reported yet. Treat "no detections" as "not known to be bad", and still judge the message itself.
Checking files
VirusTotal also scans files: upload one and it runs through dozens of antivirus engines and shows the results. You can also search by a file's hash, a unique fingerprint, to see whether anyone has scanned the same file before, without uploading it.
Your own device helps too. Microsoft Defender on Windows lets you right-click a file and scan it, macOS checks downloaded apps with Gatekeeper and XProtect, and email services such as Gmail and Outlook scan attachments automatically. See built-in antivirus.
Never upload sensitive files
Files uploaded to VirusTotal and many similar services are shared with the security community, and paid subscribers can search for and download them. Never upload anything containing personal, financial, medical or company information, such as tax forms, contracts, invoices with account numbers or internal documents.
For a sensitive file, scan it locally with your own antivirus, ask your IT team, or check its hash on VirusTotal instead of uploading it.
A word on sandboxes
Some free online "sandbox" services open a file or website in an isolated virtual machine and show what it does. They are built for security analysts. On many free plans, every submission is public, including the file, any text it contains and screenshots of what it displayed. Opening suspicious files yourself, even in a virtual machine, carries real risk if it is set up incorrectly.
For home users, the practical rule is simple: if you have to ask whether a file is safe, and you were not expecting it, do not open it.
Quick reference
| Situation | Best free check | Caution |
|---|---|---|
| Shortened link | URL expander or the shortener's preview | Do not visit the final address if it looks odd |
| Unknown website | Google Safe Browsing status, VirusTotal URL scan | New scam sites may show clean |
| Unexpected attachment | Ask the sender through another channel | Do not open macros or enable editing |
| Non-sensitive file | VirusTotal upload or hash search | Results are shared with others |
| Sensitive file | Local antivirus scan or IT team | Never upload to public scanners |
If you already clicked
- Close the page and do not enter any information.
- If you typed a password, change it right away on the real site and turn on two-factor authentication.
- If you downloaded and opened a file, disconnect from the internet and run a full antivirus scan.
- At work, report it to IT immediately. Speed matters more than embarrassment.
