How Do I Know What Website I'm Really Visiting?
This article covers how users can analyze the URL of a website to ensure they know what website they are visiting.
Check the URL carefully
The simplest way to know what website you are visiting is to the check the URL: the address of the website.
Common extensions include (but are not limited to): *.com, *.net, *.co.uk, *.jp, *.org, etc.
http://www.example.com
http://www.example.co.uk/faculty/login.php
http://example.login.main.onlinestore.com
http://example.mail.co.uk/faculty/login.php
Some Examples of Fake URLs
http://www.login.mybank.fake.com/login.php -- This URL would take you to fake.com, NOT mybank.
Hover over the URL so you know where you're going
Notice in the image above, when the mouse hovers over the link the URL is displayed at the bottom of the web browser. Hovering over a link, even one where the URL is spelled out, can be useful in figuring out if the link is okay to click.
Hover your mouse over the link below. Is the address in the text the same as the URL it is pointing to?
http://safe_and_friendly_company.com/login
Notice that although the text shows a safe URL, the link is actually programmed to go to a different URL. This is a big red flag!
About URLs
Understanding the construction of a URL is your most important defense against phishing attacks. If you're confused by a URL, it's best to ask someone for help to determine if it's safe to click it!
- URLs have domain extensions. They are located after http:// and are right before the first single-slash /. In the following example, the domain extension is .edu: http://www.fullerton.edu/it
- Each URL has a domain. The domain is located after the http:// and before the first single-slash / and they include the domain extension. In the following example, the domain is fullerton.edu: http://www.fullerton.edu/it
- Each domain has a hostname which can be confusing. The hostname of a URL is all of the left most pieces of a full internet address if there are more than 2 parts to the address. If there are only 2 parts of the address, then the hostname is equivalent to the domain name. In the following example, www.fullerton.edu is the hostname as well as the domain name: http://www.fullerton.edu/it. In this next example, the hostname is training.fullerton.edu: http://training.fullerton.edu.
- Be careful! URLs can be tricky.
- Ask yourself: does my company own this domain?
- Examine the URL in the link's destination; ignore the link's text!
Need More Help?
To learn more about phishing, view the chapter on Spear Phishing.
Contact the IT Help Desk at [email protected] or 657-278-7777 for additional assistance.
For more resources, view the Spear Phishing Help & Resources article.