How to Tell if a Website or Email is a Scam

Dissecting the Link aka the URL

An important aspect that helps in identifying and avoiding such scams is to understand what the URL is. URL is an abbreviation for Universal Resource Locator and is an address for any resource on the internet. We commonly call it “link”.

When we click on a URL (link), it takes us to a web address. The key to safety on the world wide web is to know where the link would take us.

Let us consider this link: http://www.example.com/index.html

In every URL, just like the one above, to identify the different parts of a URL, we need only note the things written between the double forward-slash “//” and the next single forward-slash “/”.

As shown in the illustration below, the highlighted part would be www.example.com.

Now, follow these steps to recognize the different parts of the URL:

• TLD: TLD stands for Top Level Domain. Reading from left to right, the last segment of the URL appearing after the final dot is the TLD, which is .com for the above example.
• Domain name: Reading from right to left, the segment from the last period to the period after that, followed by the TLD is the domain name of the URL, which is example.com for the above example.
• Subdomain: Reading from right to left, the segment between the second period and the double forward slash(//) is the subdomain, that is, www for the above example.

Refer to the illustration below for clarity.

What is a TLD?

Imagine the Internet is like a massive library, and every website is like a book on a shelf. A TLD (Top-Level Domain) is like the label on the shelf that tells you what kind of books are on that shelf.

So, when you type a web address like www.example.com into your computer, the .com part tells your computer which shelf to look on in the internet library to find that website.

Some of the popular TLDs:

• .com – generally represents private and commercial organizations
• .org – for institutions and non-profit organizations
• .net – Internet and networking related websites
• .edu – Educational institutes (universities and colleges)
• .gov – government websites

There are many more TLDs, and even country-specific ones like .in for India, .ca for Canada, etc. The country-specific TLDs are known as ccTLDs.

In certain TLDs, there are multiple layers of domains within a URL. For instance, in the URL www.google.co.uk, the .uk portion represents the TLD, while .co is called a second-level domain or 2LD. More examples of this structure include .co.jp and .co.in.

For more information, see this article from Cloudflare.

Domain Name

The domain name is the most important component of the URL or the link. Recognizing the actual domain name from the given link is the most important aspect of staying safe in the online world. Whoever owns the domain name also owns all its subdomains and email addresses.

Continuing the above analogy of the internet as a massive library, if the TLDs are like the genre of the book, then the domain name would be the book title.

In the previously mentioned URLs, that is, www.google.co.uk and www.example.com, .co.uk and .com would be the TLDs (genres of the books), and google.co.uk and example.com would be the domain names.

The key to know whether the given link is malicious or not is to recognize its real domain name. Scammers try to obfuscate the domain name by using variety of tricks. We will see some of these tricks later in this post.

Subdomain

Consider a company, Contoso, which has its headquarters in Delhi with two branches in Ahmedabad and Mumbai. These two branches and their headquarters would be equivalent to their subdomain under the Contoso domain name. If the company is analogically compared to a website, it would have two different subdomains:

• Ahmedabad: amd.contoso.com
• Mumbai: mum.contoso.com

In the above example, “amd” is a subdomain of contoso.com, and similarly, “mum” is another subdomain of contoso.com.

Subdomain do not necessarily represent branches. They can be used for anything. One domain can have multiple subdomains and these subdomains can have their own subdomains.

Examples:

• login.mail.contoso.com
• store.contoso.com
• docs.contoso.com

Examples

Let us have a look at some examples, and try to identify the domain names from given links.

#1: http://quest.find-the-treasure.com/play/start

In the above example, the domain name is “find-the-treasure.com”. The “quest” is the subdomain.

#2: https://sales-support.contoso.com/contact

Here, the domain name is “contoso.com”, and “sales-support” is the subdomain.

#3: https://cosmetics.store.example.com

Here, the domain name is “example.com”, and “cosmetics.store” represent the subdomains. To be precise, the “store” is a subdomain of “example.com” and “cosmetics” is a subdomain of “store.example.com”.

Dissecting an Email Address

Let us consider the situation portrayed in the opening of the blog. Aside from the URL, you can also identify a phishing attempt by reading the sender’s email address. Similar to a URL, the mail address may consist of three or more parts: user ID, domain name, TLD, and subdomains (optional).

In case of URLs,, the domain address is between the double forward slash(//) and the next single forward slash(/).

However, in an email address, the domain address is the component after the @ symbol. To identify the different elements, reading it similarly to a URL is sufficient to have a general outlook of the sender’s verification.

As you can see in the above illustration, the domain component is what comes after the ‘@’ symbol.

The domain component can be further split into the same components we discussed above for the URL, namely, the TLD, domain name, and subdomain, identified similarly.

Also, just like the URLs, email addresses may also feature subdomains, as shown in the illustration below.

In the above example, the domain component is “mailer.example.com”, where “mailer” is a subdomain of “example.com” domain.

Test Yourself

We are going to give you some examples of URLs and email addresses.Your job is to identify the exact domain name for each of them, and also decide for yourself whether the domain name is phony or not.

• https://infinity.icicibank.authentication-com.co.in/login
• https://incometax.gov.in.gov-india-official.com/update
• https://netbanking.hdfcbank.com-netbanking.co.in
• support@mailer.facebook.co.in.social-media.co.ru
• no-reply@email.netflix.net-flix.co.in
• gst.gov.in@tax-notice.co.jp

Scroll down to see the answers!

Answers:

• https://infinity.icicibank.authentication-com.co.in/login
  • Domain: authentication-com.co.in
  • Subdomain: infinity.icicibank
• https://incometax.gov.in.gov-india-official.com/update
  • Domain: gov-india-official.com
  • Subdomain: incometax.gov.in
• https://netbanking.hdfcbank.com-netbanking.co.in
  • Domain: com-netbanking.co.in
  • netbanking.hdfcbank
• support@mailer.facebook.co.in.social-media.co.ru
  • Sender: support
  • Domain: social-media.co.ru
  • Subdomain: mailer.facebook.co.in
• no-reply@email.netflix.net-flix.co.in
  • Sender: no-reply
  • Domain: net-flix.co.in
  • Subdomain: email.netflix
• gst.gov.in@tax-notice.co.jp
  • Sender: gst.gov.in
  • Domain: tax-notice.co.jp
  • Subdomain: –

You can see that each is an elaborate attempt to fake a real domain name. If you fail to spot such forgery, you may just be the next victim!