0

In what ways can a URL be analyzed to check whether its a Phishing page or not. Such as using target site's name somewhere in the URL, URL obfuscation, misspellings, etc. Its not possible every time that URL analysis will be able to judge whether a page is a phishing page or not, but can it be used in some cases?

So what are the different ways to analyze URL to detect phishing?

Improve this question
7
  • 1
    making sure the URL's domain points to the site you expect?
    – dandavis
    Jul 27, 2017 at 4:05
  • @dandavis sorry, I did not understand you. I mean to ask analyzing the contents/structure of URL
    – user5155835
    Jul 27, 2017 at 4:13
  • yeah, the domain is the key part of that structure that identifies in the most human-readable form possible who controls the server hosting the URL.
    – dandavis
    Jul 27, 2017 at 4:15
  • @dandavis But how would that help? If a domain says xyz, how do we know page is actually of xyz?
    – user5155835
    Jul 27, 2017 at 4:18
  • Is that some kind of philosophical question? ala "I think, therefore I am" ? The URL will go where the URL says it will go. As long as you don't get fooled by unicode or mispellings, checking the domain is effective, unless you've got other "bats in the belfry" on your network/device
    – dandavis
    Jul 27, 2017 at 4:23

1 Answer 1

Reset to default
1

Assuming that the phishing link is sent over email, the following set of details can be verified to identify whether or not they are phishing attempt of not. An algorithm which incorporates the following can detect most such instances.

  • Contradicting hyperlink

If the text of email shows a URL and the content is hyperlinked to a different URL, it is very likely a phishing attempt. For example this is a phishing link https://google.com

  • Trust factor of the domain name

Sometimes attackers might try to confuse users by creating subdomains which sound similar to trusted domains. For example > https://facebook.com.secvibe.com An unsuspecting user who is not aware of the concept of subdomains might think that the above link is from facebook.

  • Similar sounding domain names

Domain names with slight difference in spelling from the actual domain names.For eg: Facebookd.com

  • Shortened URLs

Shortened URLs need not always point towards trusted sites. People might use goo.gl or bit.ly to send phishing links.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.