Phishing Answer key

Reading a URL

Exercise:

What are the top-level domain names for these URLs:

http://www.cnn.com/tiger-woods/story.html   
http://www.buy.com.money.ru

Answer:

1. cnn.com
2. money.ru (Phishing site, not affiliated with buy.com)

Which link will you click on? #1 or #2

1. ftp://ftp.microsoft.com/software/patches/fixit.exe
2. http://www.micosoft.com/software/patches/fixit.exe

Answer:
If you answered #2 then you fell prey to a phishing attack! Notice the typo in the domain name for link #2. Spammers often register domain names with common typos for popular domain names. This is called “Typo-squatting”.

For #1, ftp:// is a just a different protocol than http. Otherwise, it is a legitimate microsoft.com domain resource.