How to inspect suspicious QR links

Use the checker to reveal the full address. In https://bank.example.com.attacker.test, the actual destination is under attacker.test. Text before an @ can also make an address misleading.

HTTP, embedded credentials, internationalized hostnames and numeric addresses deserve attention, but are not proof of abuse. HTTPS protects the connection; it does not prove the site belongs to the organization you expect.

Verify unexpected payment or sign in requests through an independently known channel. Do not trust a sticker placed over a public code. This checker does not query malware or phishing databases and cannot certify a destination as safe.