Level 1 · 1B Phishing · Lesson 1 of 3
How to read a web address and spot a fake email
Phishing is a message that pretends to come from someone you trust (your bank, a company, someone you know) so that you hand over your details or tap a link. It works because it rushes you or scares you, and when you're in a hurry you look less carefully.
The red flags
Urgency ("your account will be locked in 24 hours"), requests for passwords or personal details, a sender that doesn't match the company, links that lead to a different address, a generic greeting instead of your name, attachments you weren't expecting, and strange writing mistakes. Just one of these signs is enough reason to stop.
How to read a web address
Find the first slash "/" that comes after https://. From there, read toward the left: the name stuck to that slash is the owner. In https://banco.com.ar.seguro-login.xyz/ingresar, the owner is seguro-login.xyz. What counts is the company name plus its ending: google.com, mercadolibre.com.ar (with endings like .com.ar or .co.uk, it's three parts). Everything to the left is decoration: anyone can buy a domain and put "banco.com.ar." in front of it to fool you.
Going deeper
Checking it with code
function esDeConfianza(direccion, permitidos) {
const host = new URL(direccion).hostname;
return permitidos.some((d) => host === d || host.endsWith('.' + d));
}
esDeConfianza('https://accounts.google.com/x', ['google.com']); // true
esDeConfianza('https://google.com.verificar.net/x', ['google.com']); // false- Line 2: the browser takes the address apart and gives us just the domain (hostname).
- Line 3: it's trusted if it's EXACTLY the domain or if it ends in '.' + the domain. The dot is the key: without it, 'malogoogle.com' would pass the test.
- The last lines show a good case and a disguise that gets caught.
Review questions
In https://banco.com.ar.seguro-login.xyz/ingresar, who really owns the website?
Answer: seguro-login.xyz. The owner is the name stuck to the first slash that comes after https://. Anything to the left is decoration.
An email says "your account will be locked in 2 hours, log in now". What does that tell you?
Answer: Urgency: a typical sign of phishing. Urgency is meant to make you act without thinking. Serious companies don't threaten to lock everything within a few hours.
You get a notice from your bank with a link. What's the safest thing to do?
Answer: Go to the official website or app yourself, without using the link. If the notice is real, you'll also see it inside your account. Replying to the message only confirms that your email address exists.