What is a malicious link?¶

A malicious link is a link intended to cause harm or support unauthorised activity when it is opened or used.

Avoid the dangerous assumption¶

The dangerous assumption is that every suspicious-looking link is malicious, or that every normal-looking link is safe.

A malicious link may direct the user to:

• a fake login page
• a malware download
• a redirect chain
• a fraudulent payment page
• a tracking service
• a compromised legitimate website
• a page designed to exploit the browser or device.

The visible text may differ from the actual destination. Shortened links and legitimate redirection services can hide the final location.

Preserve the link exactly as received. Do not manually open it on an ordinary work device.

Record:

• the full URL
• the displayed text
• the source message
• the time received
• any link-wrapping or security-redirection service
• the final destination where safely established
• related domains and certificates
• the device and account used if it was opened.

A security product may have rewritten or scanned the link. The URL recorded in the email may therefore point first to the security service rather than directly to the offender’s page.

A link can be malicious even if the destination later disappears. It can also become harmless after hosting content is removed.

Opening the link does not by itself prove compromise. The page may have failed to load, been blocked, required further action or only displayed content.

Equally, the absence of a malware download does not make the link harmless if it was intended to capture credentials or payment information.

The link is one part of the evidence chain. Browser records, DNS data, network logs, website captures, account activity and device artefacts may help establish what followed.

Operational takeaway¶

Preserve the exact link without opening it unsafely, identify the destination and redirection path, and separate access to the link from any resulting compromise.