Why URLs Matter

A URL (Uniform Resource Locator) is more than just a web address; it's a key piece of information that can help you determine if a website is legitimate or a potential threat. Scammers are experts at creating URLs that look trustworthy at a glance. By learning to dissect a URL, you can spot fakes and protect yourself from phishing and malware.

The Anatomy of a URL

Let's break down a typical URL: https://www.example-store.com/category/product?id=123

1. The Protocol: https://

This is the most critical part for security.

• https:// (Hypertext Transfer Protocol Secure): The 'S' is crucial. It means the connection between your browser and the website is encrypted. You should see a padlock icon in your browser's address bar. Never enter sensitive information on a page that only uses http://.
• http:// (Hypertext Transfer Protocol): This is an unencrypted, insecure connection. Any data you send can be intercepted by third parties.

2. The Domain Name: www.example-store.com

This is the true identity of the website. It consists of three parts:

• Top-Level Domain (TLD): .com is the TLD. Others include .org, .gov, .edu, and country-specific ones like .co.uk or .ca.
• Second-Level Domain (SLD): example-store is the SLD. This is the core part of the website's identity.
• Subdomain: www is the most common subdomain, but it can be anything (e.g., shop.example-store.com or my.example-store.com).

This is where scammers play their tricks.

How to Spot a Malicious Domain Name

Look at the True Domain

A scammer might use a URL like this: https://www.paypal.com.security-update.net

At a glance, you see "paypal.com," but that's a subdomain. The actual, registered domain name is what comes directly before the TLD (.net in this case).

• Subdomain: www.paypal.com
• SLD: security-update
• TLD: .net

The real domain is security-update.net, which is not PayPal. Always read the URL from right to left until you hit the first slash (/) to identify the true domain.

Watch for Misspellings and Swapped Letters

This technique is called "typosquatting." Scammers register domains that are common misspellulations of popular sites.

• goog1e.com (using a 1 instead of an l)
• arnazon.com (using 'rn' to look like 'm')
• apple-support.com (adding hyphens to look official)

Legitimate companies rarely use hyphens with their brand name in the main domain.

Be Wary of Unfamiliar TLDs

While many legitimate businesses use newer TLDs, scammers often use cheap and obscure ones like .xyz, .top, .info, or .biz to set up temporary phishing sites. If you see a familiar brand name paired with an unusual TLD, be extra cautious.

3. The Path: /category/product

This part of the URL tells you which specific page or resource you are viewing on the site. It comes after the domain name. Scammers can also manipulate the path to look deceptive: https://www.dodgy-site.com/amazon/prime/login.html The domain is dodgy-site.com, but the path is crafted to make you think it's an Amazon login page.

4. Query Parameters: ?id=123

Everything after the question mark ? is a query string, used to send data to the web server (e.g., search terms, tracking codes). It's generally less of a security indicator, but can sometimes contain tracking information.

Conclusion

Reading a URL is a critical digital literacy skill. Before you click a link in an email or enter a password on a website, take a moment to carefully inspect the address bar. By understanding what the protocol and the true domain name are, you can avoid a vast majority of online phishing and malware scams.