Ways to Check If You’re Visiting a Safe Site
We spend so much time on the Internet today shopping, filling out forms, and paying bills. After a while, all of these sites start to look the same. Since they all look the same, many of us figure that as long as nothing looks out of the ordinary on the surface, then a site must be authentic and safe, but is it? Many of us have heard of the nefarious phishing scam: you get an email message from what appears to be your bank, for instance. This email asks you to update your account information, so you click on a link in the email that takes you an account login page that looks exactly like the bank page you login into every day, from the logo and header down to the buttons. However, if you look closely enough, you see that the web address looks slightly off; say the real web address of your bank is mylocalbank.com, but in the address bar, you see mylocallbank.com. Subtle yet noticeable red flags like this are signs of fraudulent websites that disguise themselves as legitimate websites with which you have accounts. The goal of the thieves behind these sham websites is to get you to “login” to their fake sites with your actual login information in order to acquire your account credentials. Once obtained, these thieves then go to the real bank site, login with your credentials, and steal money or valuable information from your account.
Phishing Beyond Email
Unfortunately, these thieves don’t have to rely on finding victims through fictitious email messages to run phishing scams anymore. They still design their bogus websites to resemble safe, trusted websites. But nowadays, they can actually lure victims to their sites by advertising the sites just like a regular lawful business. The criminals create normal online content like blog posts and articles. They can even list their mock business in online directories like Yellowpages.com and Yelp. They will even also post advertisements for jobs, services, and promotions on classified ad sites like Craigslist. Online frauds may even go so far as to optimize their web pages and run paid ad promotions to rank high in search engine results based on the keywords that match their “business.”
So if there are fake websites out there that look so real, then how can you determine if you’re visiting a safe website or a dangerous one? Here are some tips that can help you sort out the impostor sites from the originals.
Inspect the URL
The first giveaway to a fraudulent site that is easy to spot is a shady URL. Before you actually click on a link to what you think is a genuine website, hover your mouse over the link text and look at the URL that appears in the bottom-left corner of your browser window. If the web address you see looks jumbled or has a combination of random numbers and symbols (e.g., http://web-08334-lsjldkjl-@li33.com), then you may not want to click that link. If the address does look normal, look more closely at it, especially if you think the link goes to a familiar site. A cunning tactic that cyber crooks use is to make the URLs of their sites look similar to those of well-known, trusted web sites, such as G00g1e.com, or Faceb0ok12.com. These URLs may look pretty close to Google.com and Facebook.com, but users who fail to look closely enough may not notice the zeros used in place of the letter ‘o’ or the appended numbers, for instance. These small but crafty peculiarities are signs of a dangerous website.
Perform a Website Search
If the URL of a site doesn’t look suspicious, you don’t want to stop your security check there. The next step you can take is to do some research on a website by entering the domain name into a search engine like Google and see what comes up. Depending on how popular or new the site is, you may see a mix of online review sites or website checker sites referencing the domain in question in the search results. If you notice a pattern of sites flagging the website as unsafe or see a slew of poor reviews and complaints, then that website may not be one to visit.
Fortunately, there are also free resources from trusted online authorities that can help you check the validity of a site. With the Safe Browsing search tool from Google’s Transparency Report, all you have to do is enter a URL in the search bar to see if Google has identified a site as safe or unsafe.
Run a Whois Lookup
Anyone who registers a domain name, or web address, must provide contact information for that domain. That contact information can be looked up by just entering the domain name on https://whois.icann.org/. This site will provide the name of the domain registrant, the administrative contact, and the technical contact.
Examine the contact information for anything unusual. For instance, if the registrant’s name appears to be normal, but the registrant’s email address appears to be random, then that could be a red flag indicating that the registrant is trying to conceal his or her identity. Another scenario in checking domain registration could be that if the domain is registered privately, then the contact information is not disclosed. In this situation, the query result from the Whois lookup will display a private registration provider as the contact instead of the actual registrant. This lack of transparency could also be a warning sign that the website of the domain name is not trustworthy.
Check for a Secure Connection
Most users who have been browsing the Web long enough have noticed the “http” or “https” prefix that precedes the domain name of every site in the address bar of a browser window. This “http” prefix stands for “hypertext transfer protocol,” which is essentially the set of rules that a web browser and server follow to exchange information, such as when the browser requests access to a particular website from the server that stores and provides the website’s files. The secure version of this protocol is denoted as “https,” with the ‘s’ standing for “secure.” With a secure “https” connection, information communication on a website is encrypted to prevent data interception and theft from Internet burglars. As a matter of fact, web browsers like Google’s Chrome now warn site visitors when they are about to visit a site that does not have a secure connection. Sites using the secure protocol are usually considered to be safer and more reliable than those without it because obtaining that secure connection is typically a multi-step verification process of obtaining a security certificate from a trusted authority, a task with which most cyber criminals don’t want to be bothered. However, a site that uses “https” may not necessarily be safe; shrewd online criminals can find ways to procure security certificates for their fraudulent phishing portals. With this dilemma, the best general rule to follow is to make sure that any sites where you are making online payments or entering sensitive information are historically reputable and have that secure, “https” connection.
Aside from checking for the ‘s’ in “https,” an easy way to check if a site is secure is to look for a locked padlock icon to the left of the domain address in the browser address bar. If that padlock is unlocked or has a red strikethrough or ‘x’ over it, then the site is not using a secure connection. In that case, do not perform any kind of payment transactions, fill out forms, or login to any accounts. It may also be a good idea to avoid purchase transactions on sites where the padlock has a yellow warning triangle with an exclamation mark over it. Padlocks with warning signs or symbols of uncertainty indicate that the connection is only partially secure with partial encryption, so connection infiltration and data theft are still possible.
Look for Bad Content
Another thing to consider in the legitimacy of the website is the content on the site’s pages. If the written content has any misspellings or improper grammar, that could be an indication of a phony site. The content could also contain strange phrases or word choices that do not sound natural or don’t sound like they were written by a native speaker, which is an even stronger red flag of a counterfeit site.
Identify Suspicious Ads and Messages
Many web pages, including safe ones, have online advertisements displayed in various areas on each page. But if you notice an unusually high number of ads on a page, especially ads that crowd the page or automatically play videos, then the site may not be safe. Another red flag is if ads display messages asking you to take action, such as taking a survey, or the ads say you have a computer virus and need to click a link or call a phone number to buy an anti-virus program. These kinds of ads that ask or scare you into taking an action almost always take you to another site that asks you for information to scam you out of money or sensitive data.
Consider How Much Information is Being Requested
On sites providing services such as banking or insurance, it’s normal for users to be asked to provide detailed personal information like email or mailing addresses. However, if you notice that the site is asking for a lot of information, such as your driver’s license number, date of birth, and your entire social security number on top of the standard information, it may be safer to exit that site. Legitimate sites normally never ask for an exhaustive list of personal details. As a matter of fact, safe sites usually only ask for the last four digits of your social security number (SSN), which is because they already have your complete SSN on file and want to verify that an authorized user is accessing the site.
Check for Return and Shipping Policies
If you’re on an ecommerce site, look for return policy and shipping policy pages. Real online marketplace websites usually display links to these pages in the header and footer of every page, and these pages provide thorough details on how to return items, obtain refunds, and how to check the shipping status of orders. If these pages are nowhere to be found or if the information on these pages looks incomplete or confusing, then the site may not be on the up and up.
See if There’s a Contact Page
Businesses with legitimate websites will have a Contact Us page that normally lists details like phone numbers and physical address locations. If the site has no contact page at all or if the page only provides an email address or contact form to fill out, then you many not want to perform any transactions on the site.
Stay Safe on the Web
These practical everyday tips can help you steer clear of dangerous sites on the Internet, but if you want to become an expert on website security, start getting a strong foundation by taking courses from Cybrary’s catalog of cybersecurity courses. Here are some great courses to start with: