0

I'm getting a lot of scams on my mobile phone, and have just tried explaining to my wife how to find out who the 'owner' (network host name?) of a URL is before clicking on it. The basics are obvious - scan from the right till you find the TLD, work back to the left. But, of course, this is non-trivial, and I gave up. TLDs have proliferated to the point where they're useless, some countries have a second-level hierarchy and some don't, and the real killer is that the filename portion of the URL can contain dot characters and can (I think) look like a domain.

Is there an algorithm which can always extract an org name from a URL? For bonus points, does anyone know of a website that'll do this for you? A whois search should do the job, of course, but the output is generally too complex for an amateur to understand.

Simple example, which I received yesterday, with no page portion: https://nhs.uk.pcr-kit.co.uk (which is 'safe'according to Google and VirusTotal, but which is a Covid contact testing scam).

Improve this question
2
  • 1
    Org cannot be determined from a URL. Only the domain. Do you mean "org" or do you mean "domain"?
    – schroeder ♦
    Aug 10, 2021 at 11:05
  • Do you want to know the legitimate owner or do you want to know if it is a known bad link?
    – schroeder ♦
    Aug 10, 2021 at 11:08

1 Answer 1

Reset to default
1
  1. scan from the left until you get to the first / or the end of the URL
  2. backtrack left dot by dot past TLD (and country TLDs, if present)
  3. that's the domain

Country TLDs take some experience to know, but if you are from a country that uses them, you get to know the patterns quickly.

I've taught this process to hundreds/thousands of people of varying technical knowledge levels and it makes sense after a couple of guided practice runs.

The non-standard TLDs are most often used for malicious purposes (research shows over 95%? Sorry water.aero ... ) so a non-standard TLD is a red flag, especially if the link is supposed to represent a well-established entity.

There is no 100% method to determine a bad URL, but you can get to know how to flag 99% of the probably suspicious URLs.

Improve this answer
2
  • 1
    "backtrack left dot by dot past TLD (and country TLDs, if present)" - this is less simple than it sounds. Rules vary for TLD and even inside a single TLD. One need to find out the public suffix first, see publicsuffix.org
    – Steffen Ullrich
    Aug 10, 2021 at 12:13
  • Never said it will work 100% of the time, but we're not coding a URL parser, but teaching people how to find the likely domain. Yes public suffixes can be long, but as I said, if you normally deal with them, you get to know them quickly.
    – schroeder ♦
    Aug 10, 2021 at 12:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.