A Beginner’s Guide To Investigating Suspicious URL
Cybercriminals still use a lot of deceptive links (phishing) via SMS, WhatsApp, and email to steal credentials and money from people. There has been a widespread of these links across social media lately. An average internet user often lack the technical knowledge to verify these links before clicking.
These article is a step by step guide and simple ways to verify the authenticity of any URL before clicking on them no matter how urgent the message being passed across seem to be.
Regardless of your background in IT, If you follow through with this, you will be able to learn how to spot red flags, safely inspect links, use free verification tools, and make safe decisions.
Here are some Social Engineering tricks to look out for to ensure you’re not about to get scammed.
- A Manufactured Urgency: Be highly suspicious of messages that manufacture a crisis or sense of urgency (e.g., “final notice,” “your account will be suspended”)
- Requests for Verification Codes: No legitimate bank, IT department, or service will ever contact you and ask you to read out a one-time passcode or Multi-Factor Authentication (MFA) code. If someone asks for this code, they are actively trying to break into your account.
- Domain Spoofing: Always expand the sender’s details to view the actual domain, not just the display name.
- Out-of-Character Requests from Known Contacts: If a familiar contact or vendor suddenly asks you to do something they have never requested before, treat it as a red flag. Their account may have been compromised.
Case Study 1
This first case study was sent to a multiple users impersonating UBA. Imagine receiving a text message saying your UBA account has an issue with account transactions and you have to click this link to verify your identity. The urgency is your first clue to pause.
URL- hxxps://ubagroupid[.]com/
The first tool I would be recommending for this analysis will be VirusTotal (https://www.virustotal.com/gui/home/upload) VirusTotal is a URL reputation checker. It asks dozens of different antivirus engines and security databases if a link is known to be malicious.
Defang the URL (hxxps://ubagroupid[.]com/[.]nigeria/) or Long-press (press and hold) the link until a menu pops up. Do not tap it quickly. Copy the link and paste on VirusTotal.
As at the time I checked this URL on VirusTotal, security vendors haven’t flagged this URL as malicious. From here you can also see the IP address (8.222.190.93) upon analyzing the IP address on VirusTotal, you can see also that a security vendor (alphaMountain.ai ) has flagged the IP address as Suspicious.
To get more details of the domain, I will be using whois (https://www.whois.com/) to check for their registration details.
From the domain registration Information, It’s very obvious this domain was created for the sole aim of exploiting people. The Domain was registered on 19th October, 2026 while the phishing SMS was sent the next day being 20th October, 2026.
Get Amarachi Obiajulu’s stories in your inbox
Join Medium for free to get updates from this writer.
Another tool we will be using for this URL Analysis is URLScan.io (urlscan.io) This tool works as a behavioral analyzer and sandbox. It visits the website for you and takes a screenshot, allowing you to see what the site looks like without actually putting your device at risk.
URLScan.io also provided more details about the domain. By the left is a screenshot of what the site looks like when you click on the link. This helps with verifying the site activities without having to click on the link.
Url2Png (https://www.url2png.com/) is a powerful tool for capturing snapshots of any website, right in your app, quickly and reliably.
From the screenshot below the site just loads endlessly while displaying a white background but it will most likely have a different effect when someone with an actual account with UBA clicks on the link.
Case Study 2: The Fake FRSC Service Link
URL: hxxps://www[.]fctevreg[.]cam/z
The threat actors tried to impersonate The Federal Road Safety Corps (FRSC) which is Nigeria’s lead agency for road traffic administration, safety management, and highway law enforcement. One of the major red flag on this URL is the unusual .cam extension. legitimate government sites in Nigeria use .gov.ng.
Upon submitting the URL to VirusTotal for analysis the link, the result showed that about 5 different vendors have flagged the link as both phishing and a malicious link.
The IP Address 43.165.173.182
Also, used Whois to get more details of the domain. The domain registration details is also a red flag, the domain was registered few weeks before the message was sent across to people.
In Conclusion, based on the URL’s we investigated, always look for typos or extra words (e.g., ubagroupid instead of ubagroup). Look at the ending. Is a Nigerian government service using .cam instead of .gov.ng Pausing to spot the red flags, inspecting the URL for subtle misspellings, and verifying links with some free tool I shared in the walkthrough are some of the recommended best practices for staying protected online. Stay alert, trust your instincts, and think before you link.
