How SecureLint Stops Phishing Links in Emails with Real-Time Popup Warnings

The most dangerous moment in a phishing attack is a single click. A carefully crafted email creates urgency, the link text looks legitimate, and muscle memory takes over. By the time the phishing page loads — even for a fraction of a second — tracking pixels have fired, your browser fingerprint has been collected, and the attacker knows the lure worked.

SecureLint Link Guard operates at the moment of click — evaluating the destination URL across multiple risk signals and intercepting dangerous navigations with a clear Unsafe Link Detected popup before the phishing page can load. For safe links, the navigation proceeds instantly with zero interruption.

The moment of click: where most phishing succeeds

Email gateways scan links at delivery time — but phishing infrastructure is designed to be clean at delivery and malicious at click time. Common techniques attackers use to defeat time-of-delivery scanning:

• Time-delayed activation — The phishing page serves a benign page for the first few hours, then switches to the credential-harvesting page after the email gateway has cached it as safe
• Link redirectors through trusted services — Links go through Google Redirect, Bing redirect, or legitimate URL shorteners, which gateway scanners whitelist by default
• Geo-fencing and user-agent gating — The phishing page only serves the malicious content to specific IP ranges or user agents, serving benign content to scanner IP addresses
• QR code links — Links embedded in QR codes inside email images bypass text-based link scanners entirely

None of these techniques defeat SecureLint Link Guard, because it evaluates the link at click time, in the same browser and from the same IP as the user — not from a remote scanning infrastructure at delivery time.

How SecureLint Link Guard works

When you click a link on any web page, SecureLint intercepts the click event before the browser follows the navigation. The interception takes under 150 milliseconds — imperceptible for safe links (which are immediately followed), noticeable only when the popup fires for a risky link.

The interception process:

1. Click capture — SecureLint's content script listens to click events on all <a> elements and programmatically-initiated navigations using window.location
2. URL extraction — The full destination URL including any redirect chain visible in the href is extracted
3. Risk scoring — The URL is scored against SecureLint's signal set (see below). This is a local computation requiring no network round-trip
4. Decision — If the score is below the threshold, navigation proceeds. If above, the popup appears and navigation is suspended until the user makes a choice

Signals evaluated on every link click

• Domain age — Domains registered within 14 days of the click date are flagged high-risk
• SSL certificate age and issuer — Certificates issued within 72 hours on Let's Encrypt or ZeroSSL against a new domain are a phishing indicator
• Brand impersonation — The domain is matched against patterns for 500+ major brands using lookalike detection, hyphen insertion, and Unicode homograph normalisation
• Known phishing URL database — The URL is checked against SecureLint's live feed of confirmed phishing URLs
• Redirect chain analysis — Multi-hop redirectors are followed and each intermediate domain is scored independently
• URL encoding and obfuscation — Double-encoded URLs, Unicode path encoding, and base64 URL obfuscation patterns are decoded and scored
• TLD risk score — High-abuse TLDs (.xyz, .top, .click, .gq) receive a base risk penalty when combined with other signals

The Unsafe Link Detected popup

When a link scores above the risk threshold, SecureLint injects a modal popup over the current page — the phishing page never loads behind it. The popup contains:

• The full destination URL clearly displayed
• An overall risk score from 0–100 with a colour-coded severity indicator (green / amber / red)
• A plain-language breakdown of each triggered signal, e.g.: “Domain registered 3 days ago”, “Brand impersonation: PayPal detected”, “SSL certificate issued 6 hours ago”
• Go Back (Safe) button — cancels the navigation and returns you to the email
• Proceed Anyway button — follows the link with an explicit risk acknowledgement logged

Hover-preview risk scoring

Before you even click, SecureLint scores links when you hover over them in email clients. A small tooltip appears above the hovered link showing a risk level indicator (Safe / Caution / Dangerous) so you can make an informed decision before clicking. High-risk links show a red indicator directly in the email body.

Where Link Guard works

SecureLint Link Guard is active across all web-based applications:

• Gmail (mail.google.com) — link clicks and hover previews in email body
• Outlook Web (outlook.live.com, outlook.office.com) — including links in junk mail and forwarded messages
• Slack Web — links in channel messages and direct messages
• Notion, Confluence, Linear — links in documents and comments
• Any web page — Link Guard's click interception is not limited to email clients. It protects every link click in any web-based application

Setting up Link Guard in SecureLint