Most scam texts want you to tap a link. The Link group on the Why? screen (and the link preview) explains what's unusual about a link's address. 1krBlocker checks the address only; it never opens the page.
- "Contains a link to …": just that there's a link.
- "Uses a short link that hides where it really goes (…)": bit.ly and similar hide the real site. Turn on Follow short links in Settings to see where they lead (it contacts the link service).
- "Mentions …, but the link goes to …, which … doesn’t own": the classic trick, for example "dhl" or "inpost" somewhere in an address that belongs to someone else. What counts is the website name just before the ending (.com, .pl…), which the link preview highlights.
- "Link uses look-alike letters to imitate another website (…)": letters from other alphabets that look like ours (a Cyrillic "а" instead of "a"). The preview shows its real form: "The address uses letters from other alphabets that can imitate a real website. Its real form is …"
- "Link uses a web address ending often used by scams (…)": some endings are cheap and popular with scammers.
- "Link points to a bare IP address instead of a website name (…)", "Link uses an unusual connection port (…)", "Link has an unusually long, layered address (…)", "Link hides its real destination after an “@” (…)" and "The link is disguised to get past filters (…)": ways to disguise where a link really goes. Real companies don't need them.
- "Link leads to a login or payment page (…)": be careful where you type passwords or card details.
- "Link downloads an app installer (…)": an app installer from a text message is how phone-stealing malware spreads. Never install it.
When a link's site is on a list of known dangerous websites, see "Known dangerous website".