← Years 7–8 Digital Systems

Checking links and fake websites

A link whose shown text hides a different real web address. Hover to check the address before you click or log in, watch for look-alike names, or type the address yourself.

Part of: 7-8 Digital Technologies Vic Curric - Digital Systems and Security — Module 64, 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 57, IGCSE Computer Science 0478 — 5.3 Cyber Security — Module 38, ACARA Digital Technologies Years 5–6 — Staying Safe Online — Module 24, ACARA Digital Technologies Years 7–8 — Networks and Cyber Threats — Module 13, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 69

Understanding Checking links and fake websites in Years 7–8 Digital Systems

What it does: Hovering reveals the true web address without opening the page, which lets you spot a mismatch with the displayed text. If you type the address you know is correct, you do not rely on a link that might be hiding a different destination. Scammers swap letters for numbers, like the letter l for the number 1, so a fake address looks real at a quick glance. The real domain is the part just before the final ending. In the fake, the domain is refund-claims.com, and ato.gov.au is only a decoy at the start. A fake site may have captured your password. Change it quickly on the real site, and use a different password anywhere else you re-used it.

Common mistakes: The real address must come from hovering over the link, not from the text that is shown. The line should be: real ← hover(link). The test is backwards. You should be warned when the real address does NOT match the bank's address. It should be: if real ≠ 'bank.com.au' then.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Checking links and fake websites to a class →

This module's key terms are also in a printable crossword (Modules 26–74) and word search (Modules 4–74).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A link says 'www.mybank.com.au' but hovering shows a different address in the corner of the screen. Which is true?
The shown text is always the real destination, so it is safe to clickThe real destination can differ from the shown text, so don't click
Matches
Link says: www.myschool.edu.au -> goes to: myschool-login.xyz. Safe, because the text looks right!
↓
Trusting the displayed text without checking the real address, which is a different domain.
Applying
Meanings
Term
Misleading link
Meaning
A link whose shown text hides a different real web address. Hover to check the address before you click or log in, watch for look-alike names, or type the address yourself.
Practice
<!-- Shown text hides the real address -->
Testing
Gaps
<a ="https://mybank.com.au">Log in</a>
Check Answer
Spots
1shown ← 'www.mybank.com.au'
2real ← shown

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Giant Squid' badge — Nested Navigator, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A link says 'www.mybank.com.au' but hovering shows a different address in the corner of the screen. Which is true?
A. The real destination can differ from the shown text, so don't click ✓
B. The shown text is always the real destination, so it is safe to click
Link text can say one thing while the real web address is different. Hovering lets you see where it really goes.
2. Which is a good way to check where a link goes on a computer, before you click?
A. Click it quickly and see where it goes
B. Hover over the link and read the address that appears ✓
Hovering shows the real address without opening the page. Clicking first could take you to a fake website.
3. Which web address is a look-alike of paypal.com?
A. paypa1.com ✓
B. paypal.com
Scammers swap letters for numbers, like the letter l for the number 1, so a fake address looks real at a quick glance.
4. You get a message saying your streaming account is locked, with a link to log in. What is the safest choice?
A. Type the website address yourself into the browser ✓
B. Log in using the link in the message
Typing the address yourself takes you to the real site. A link in a message might lead to a fake login page.
5. Which address most likely belongs to the real Australian tax office, ato.gov.au?
A. www.ato.gov.au.refund-claims.com
B. www.ato.gov.au ✓
The real domain is the part just before the final ending. In the fake, the domain is refund-claims.com, and ato.gov.au is only a decoy at the start.

Match the Pairs

<a href="http://evil-site.com">mybank.com</a> → A link whose shown text says mybank.com but whose real destination is a different, dodgy address
paypa1.com → A look-alike domain name that swaps the letter l for the number 1 to trick you
Hovering over a link shows its real destination in the bottom corner of the browser, so you can check it before clicking → Hover the mouse over: Click here to log in
Typing the address yourself avoids a fake link because you go straight to the real website → https://www.commbank.com.au
Link says: www.myschool.edu.au -> goes to: myschool-login.xyz. Safe, because the text looks right! → Trusting the displayed text without checking the real address, which is a different domain.
www.netflix.account-verify.com is the real Netflix site because it starts with netflix → The real domain is account-verify.com, and netflix is only a subdomain placed at the front to fool you.

Key Term

Misleading link
A link whose shown text hides a different real web address. Hover to check the address before you click or log in, watch for look-alike names, or type the address yourself.

Fill in the Blanks

1. <a href="https://mybank.com.au">Log in</a>
Hint: Type the attribute that holds the link's real destination address.
2. <a href="https://mybank.com.au">Log in</a>
Hint: Type the tag name that creates a clickable link.
3. shown ← "mybank.com.au" real ← "mybank-login.net" IF real ≠ shown THEN DISPLAY "Fake"
Hint: Type the operator that checks the two addresses are different.
4. typed ← "https://mybank.com.au" OPEN(typed)
Hint: Type the variable holding the address you typed yourself.
5. IF hover_address != "mybank.com.au" THEN DISPLAY "Fake link - do not click" END IF
Hint: Type the keyword that starts a decision.

Spot the Error

Question 1
A shown ← 'www.mybank.com.au'
B real ← shown
C if real ≠ shown then
D show warning
Line B — The real address must come from hovering over the link, not from the text that is shown. The line should be: real ← hover(link).
Question 2
A email ← 'Verify your account'
B real ← hover(email)
C if real = 'bank.com.au' then
D do not log in
Line C — The test is backwards. You should be warned when the real address does NOT match the bank's address. It should be: if real ≠ 'bank.com.au' then.
Question 3
A click link in the text message
B check the padlock and name
C then log in
Line A — Typing the address yourself is the safe way to reach a site. Clicking a link in a message could lead to a fake site. It should be: type address into the browser.
Question 4
A name ← 'amazon.com.au'
B seen ← 'amaz0n.com.au'
C if seen ≠ name then safe
Line C — The seen address has a zero instead of the letter o, so it is a look-alike domain. If the names do not match, the site is fake, not safe.
Question 5
A link ← 'Win a free phone!'
B real ← hover(link)
C if real is not trusted then
D enter my password
Line D — If the real address is not trusted, you should leave the page. You should never enter your password on it. The line should be: leave the page.

Student with a class code? Join your class →