2

I have noticed some phishing emails that copy format that Google or Gmail use in their URLs for account login or OAuth logins:

https://accounts.google.com/

I've seen URLs like 

http://accounts.fishyname.google.asdf.com

but I don't remember the exact layout of the fake URL, but it was similar to that.

Q: Is there a general rule to follow to be sure that it's the actual site you think it is, e.g. Google?

I know it should have the secure (lock) symbol, but what about the layout of the URL part?

Improve this question
1
  • It seems that the hierarchy is read from right to left. So before the '.com', you would expect to see 'google', then 'accounts', as accounts domain belongs to google domain. Can use this to make sure it's legit url
    – Drenai
    Commented Dec 9, 2016 at 12:34

1 Answer 1

Reset to default
2 
http://accounts.fishyname.google.asdf.com

You do need to have some knowledge of URL/domain structure in order to assess whether this is the real deal or not just by looking at it. In this case the domain is clearly asdf.com - which is obviously not Google.

As you mentioned in comments, the "hierarchy" is right to left. .com is the top-level-domain (TLD) under which anyone can register a domain name. Once someone has registered a domain then they can create any number of (suspicious looking) subdomains for that domain they like (as in your example). Your example shows 3 additional subdomains: accounts.fishyname.google.

If you look up asdf.com in a WhoIs database then it will report the registered owner of that domain (although this could be protected with a private registration service).

You also have to be careful of domains which might look very similar to the real thing - due to the use of unicode lettering. See IDN homograph attack (Wikipedia). For instance, there was a recent case where a Russian spammer registered ɢoogle.com (that's a small-cap G, not g at the beginning) to try to dupe the unwary. Reference: https://www.bleepingcomputer.com/news/security/russian-spammer-uses-fake-google-domain-to-tell-webmasters-to-vote-trump/

I know it should have the secure (lock) symbol

Simply having the lock symbol (ie. HTTPS) doesn't tell you anything about who you are connecting to. You might simply be connecting to a malicious website... securely!

Only if the SSL cert is an extended validation certificate (the green bar in the address bar) and you take the time to check the name, can you be sure who you are connecting to.

Improve this answer
2
  • Hi. Thanks. Am I correct in thinking that if the site is purporting to be Google, that regardless of the subdomains, it should be in the format xxx.xxx.google.com, i.e. with google.com at the end?
    – Drenai
    Commented Dec 9, 2016 at 14:01
  • 2
    Yes, although Google owns a lot of domains with different ccTLDs (Country-Code-TLDs), eg. google.co.uk, google.co.id, etc. (Although most services are probably served from google.com.)
    – MrWhite
    Commented Dec 9, 2016 at 14:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.