This is where knowing how to tell if a website is legit really plays in your favor. This article breaks down several key things you should watch when clicking on links in emails and web search results in your browser.<\/p>\n\n\n\n
Not Sure How to Tell If a Website Is Legitimate? Here\u2019s What to Look Out For\u2026<\/h2>\n\n\n\n
One of the biggest giveaways of a fake website is its design and language usage. For example, if you\u2019re in a rush and type in amazon.com but find yourself on a slightly different-looking website, stop and really<\/em> look at the website. Ask yourself a few quick questions:<\/p>\n\n\n\n If your answer to any of these questions is yes<\/em>, then it\u2019s likely that you\u2019ve stumbled upon a phishing website. But aside from these visual cues, how do you know if a website is legitimate? There are several other great ways to know if a website is legit. We\u2019ll quickly over each of these methods to get you on your way.<\/p>\n\n\n\n This first item on our list is one of the most important tasks when it comes to telling if a website is authentic or a fraud. Cybercriminals are all about deception; one of the ways they do this is by embedding fake website links into legitimate-looking anchor texts and buttons that they can send in emails, SMS text messages, and hide on websites.<\/p>\n\n\n\n Someone can trick you into clicking on a malicious URL<\/a> by hiding it in a misleading button, graphic, or another element. Say, someone sends you an impersonating Microsoft (which isn\u2019t hard to imagine considering that Microsoft is one of the most-impersonated companies globally by cybercriminals). The email tells you that your account\u2019s autorenewal subscription payment has been processed and that you must log in to view the payment or to request a refund. The sender\u2019s message includes a convenient button that says Login to Your Microsoft Account<\/em>, which takes you to a login page when you click on it.<\/p>\n\n\n\n The attacker\u2019s goal here is to get you to click on the website without first checking whether the destination website is authentic. When you enter your login credentials on the phony website, the attacker steals them and can use them to access your legitimate Microsoft account.<\/p>\n\n\n\n You can tell if a website is legitimate by moving your mouse (cursor) over the embedded link or button in question without clicking on it. Doing this causes the hidden destination URL to appear as a hovering box above the link or button. Let\u2019s look at a quick example:<\/p>\n\n\n\n In this example, if you hover your mouse over either the banner image or the Access Your Data<\/em> button, you\u2019d see the highlighted hidden URL display. This is the real destination URL that you\u2019d be taken to if you click on either option.<\/p>\n\n\n\n Check out our blog to see other real-world phishing email examples<\/a>.<\/p>\n\n\n\n One of the easiest ways cybercriminals like to trick unsuspecting users is by creating websites with domains similar to those owned by legitimate companies to trick people into landing on them. (This is known as typosquatting<\/a>.) For example, someone could register the domains mirosoft.com<\/em> or micr0sft.com<\/em> with the hopes of tricking users who:<\/p>\n\n\n\n Be sure to keep your browser updated as well. Older versions of the Google Chrome, Mozilla Firefox and Opera web browsers were susceptible to homograph attacks. These attacks involved a bad guy creating<\/p>\n\n\n\n Unicode domains \u2014 meaning web addresses that incorporate non-ASCII characters (i.e., non-English characters) that look visually identical to English letters \u2014 are particularly tricky to identify. Also known as homograph attacks, attackers take advantage of a bug in browsers that allows users to create similar-looking website URLs that are visually indistinguishable from legitimate websites by replacing a character with a similar-looking character in another language\u2019s alphabet.<\/p>\n\n\n\n The guy who discovered this bug (Xudong Zheng) in 2017 walks you through how the process works<\/a> more in depth on his site. In a nutshell, registering the domain \u201cxn\u201380ak6aa92e.com\u201d allowed him to replace the letter L<\/em> in apple.com with a Cyrillic letter I<\/em>. This enabled the fake domain to display visually as apple.com<\/em>.<\/p>\n\n\n\n Thankfully, the browsers quickly addressed this issue a few years ago in their subsequent version updates. But if you\u2019re using a browser that hasn\u2019t been updated, you\u2019re still at risk as it\u2019s visually impossible to tell if a website is legit or fake. You\u2019d have to copy-and-paste the URL into notepad or a URL scanner tool to check its authenticity. Now, when you try going to similar Unicode websites, you\u2019ll receive this type of error:<\/p>\n\n\n\n Speaking of URLs, this brings us to our next talking point\u2026 <\/p>\n\n\n\n One of the most important steps you can take is running a website\u2019s URL through an antivirus and\/or antimalware scanner before entering it in your browser. This method of knowing how to tell if a website is legit entails using the companies\u2019 databases of known threats and scanning technologies to help you determine whether a site is legit or might be an imposter.<\/p>\n\n\n\n Here are a few examples of the types of tools you can use for free:<\/p>\n\n\n\n Relying on third-party scanners isn\u2019t the only way to check the legitimacy of a website. You\u2019ve got another important trick up your sleeve \u2014 you just might not know it. One of the most important ways to know how to tell if a website is legit is to check its website security certificate information.<\/p>\n\n\n\n Say, you\u2019ve searched for a product in Google and clicked on a website. How do you know it\u2019s the \u201creal deal\u201d or an imposter website now that you\u2019re on it? Look at the web address bar \u2014 do you see a small padlock icon? This indicates that the website you\u2019re on is secure because it\u2019s got an SSL\/TLS certificate installed that facilitated a secure, encrypted connection. (I.e., bad guys can\u2019t steal your info in transit<\/a> because they don\u2019t have the necessary decryption key).<\/p>\n\n\n\n This is great if the website you\u2019re on is legitimate, but what if the site you\u2019re on is a fake one that\u2019s operated by a cybercriminal? Yikes \u2014 it means that you\u2019re sending your sensitive information to them encrypted, but that they have the secret key that allows them to decrypt that data. This is why you also need to verify the digital identity of the organization that owns the website. You can do this by:<\/p>\n\n\n\n Of course, you don\u2019t have to stop there \u2014 you can take this to the next level by actually using other official records and resources to verify the company\u2019s information yourself. You can do this by taking the organization\u2019s information and checking it against records from the following resources:<\/p>\n\n\n\n However, it\u2019s important to note that you\u2019ll only see this information on websites that use organization validation<\/a> (OV) or extended validation<\/a> (EV) SSL\/TLS certificates. These certificates offer basic business validation and extended validation, respectively, with EV being the highest level of business validation<\/a>.<\/p>\n\n\n\n For them to be issued to the website, a publicly trusted third party (i.e., a certificate authority) has to verify specific information about the requesting organization to verify whether it\u2019s legitimate. This is known as a validation check<\/a>. Think of it as a background check for the website that verifies the organization\u2019s digital identity using official resources from reputable third-party like Brad & Dunstreet<\/a>.<\/p>\n\n\n\n If a website only uses the minimum level of validation \u2014 domain validation<\/a>, or DV SSL certificates \u2014 it means that the site only had an automated system check its domain ownership. As a result, it won\u2019t display any organizational information for you to verify.<\/p>\n\n\n\n Alright, that concludes our list of steps for how to tell if a website is legit. Unfortunately, phishing and malicious websites are some of cybercriminals\u2019 favorite tools, so they aren\u2019t going anywhere anytime soon. But we hope that you now have a better idea of how to distinguish fake websites from real ones.<\/p>\n\n\n\n Of course, if you come across a fake or fraudulent website, be sure to report it. Doing this helps to bring the site to the attention of browsers so that you can help prevent other people from becoming victims of these fake websites. There are a few ways you can report fake and malicious websites to both the FBI\u2019s Internet Crime Complaint Center (IC3)<\/a> and Google\u2019s Safe Browsing Report Phishing Page<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" Not sure how to know if a website is legit? If your answer is no, you\u2019re likely to find yourself the target of a phishing scam sooner or later. Here are 5 ways to tell if a website is legitimate or is as fake as a $3 bill Phishing is one of cybercriminals\u2019 favorite tools<\/p>\n","protected":false},"author":8,"featured_media":7424,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[417,135],"tags":[641],"class_list":["post-7416","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","category-website-security","tag-how-to-tell-if-a-website-is-legit"],"yoast_head":"\n1. Check the Legit URL By Hovering Your Cursor Over Embedded Links & Buttons<\/h3>\n\n\n\n
![\"A](\"https:\/\/cheapsslsecurity.com\/blog\/wp-content\/uploads\/2022\/06\/phishing-email-example1-fake-url.png\")
2. Double-Check the URL Spelling for Small Variations (And Watch Out for Typos!)<\/h3>\n\n\n\n
Beware Unicode Domains<\/h4>\n\n\n\n
![\"A](\"https:\/\/cheapsslsecurity.com\/blog\/wp-content\/uploads\/2022\/06\/phishing-email-example-unicode-domain.png\")
3. Check a Website\u2019s URL Using One or More Reliable Third-Party Security Tools<\/h3>\n\n\n\n
4. Check the Organization\u2019s Information in the Site\u2019s Security Certificate<\/h3>\n\n\n\n
![\"A](\"https:\/\/cheapsslsecurity.com\/blog\/wp-content\/uploads\/2022\/06\/ebay-website-certificate-1024x573.png\")
![\"A](\"https:\/\/cheapsslsecurity.com\/blog\/wp-content\/uploads\/2022\/06\/ebay-website-certificate2-1024x571.png\")
![\"A](\"https:\/\/cheapsslsecurity.com\/blog\/wp-content\/uploads\/2022\/06\/ebay-website-certificate-compilation.png\")
5. Verify the Company\u2019s Information By Looking at Other Official Records & Resources<\/h3>\n\n\n\n
![\"A](\"https:\/\/cheapsslsecurity.com\/blog\/wp-content\/uploads\/2022\/06\/icann-domain-info-ebay.png\")
Final Thoughts on How to Tell If a Website Is Legit (And What to Do If It\u2019s Not)<\/h2>\n\n\n\n