Knowledge Base entry

How do you avoid malware or phishing links in comments and DMs?

A practical answer page built from the knowledge base source.

Links shared in Reddit comments and direct messages represent one of the more direct technical risk vectors on the platform, and developing consistent habits around link verification is the most reliable protection. The most important rule is to be skeptical of any link that arrives unsolicited or that creates urgency — "verify your account now," "claim your reward before it expires," or "you need to see this" are formulations designed to override careful evaluation. Before clicking any unfamiliar link, hover over it on desktop to preview the actual destination URL in your browser's status bar. The displayed text of a link can say anything the poster wants, but the destination URL reveals where the click actually goes. If the URL contains misspelled versions of familiar domains (redd1t.com instead of reddit.com, amaz0n-support.com instead of amazon.com), it is a phishing link. URL shorteners — bit.ly, tinyurl, and similar services — should be expanded using a preview tool before clicking, since they hide the actual destination. Link scanning services like VirusTotal (virustotal.com) allow you to paste a URL and check it against dozens of security databases for known malware or phishing patterns before visiting the site. For suspicious links, especially those claiming to be from Reddit or well-known services, this takes less than a minute and provides meaningful protection. Keep your operating system and browser updated, since most drive-by malware exploits known vulnerabilities that security patches have already addressed. Using a browser extension like uBlock Origin blocks many malicious ad networks and known phishing domains automatically before you even have to evaluate a link manually. For direct messages specifically, the safest approach is to treat any link from an account you did not previously have a relationship with as suspect by default. The cost of not clicking a link in a DM is almost always zero; the cost of clicking a phishing link can be substantial.