Checking links and fake websites

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A link says 'www.mybank.com.au' but hovering shows a different address in the corner of the screen. Which is true?

A The real destination can differ from the shown text, so don't click

B The shown text is always the real destination, so it is safe to click

2. Which is a good way to check where a link goes on a computer, before you click?

A Click it quickly and see where it goes

B Hover over the link and read the address that appears

3. Which web address is a look-alike of paypal.com?

A paypa1.com

B paypal.com

4. You get a message saying your streaming account is locked, with a link to log in. What is the safest choice?

A Type the website address yourself into the browser

B Log in using the link in the message

5. Which address most likely belongs to the real Australian tax office, ato.gov.au?

A www.ato.gov.au.refund-claims.com

B www.ato.gov.au

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1<a href="http://evil-site.com">mybank.com</a>		Ahttps://www.commbank.com.au
2paypa1.com		BA look-alike domain name that swaps the letter l for the number 1 to trick you
3Hovering over a link shows its real destination in the bottom corner of the browser, so you can check it before clicking		CA link whose shown text says mybank.com but whose real destination is a different, dodgy address
4Typing the address yourself avoids a fake link because you go straight to the real website		DTrusting the displayed text without checking the real address, which is a different domain.
5Link says: www.myschool.edu.au -> goes to: myschool-login.xyz. Safe, because the text looks right!		EHover the mouse over: Click here to log in
6www.netflix.account-verify.com is the real Netflix site because it starts with netflix		FThe real domain is account-verify.com, and netflix is only a subdomain placed at the front to fool you.

Definitions

Misleading link

Fill in the Blanks

Complete each line of code by filling in the missing parts.

<_ href="https://mybank.com.au">Log in</a>

shown ← "mybank.com.au" real ← "mybank-login.net" IF real _ shown THEN DISPLAY "Fake"

typed ← "https://mybank.com.au" OPEN(_____)

__ hover_address != "mybank.com.au" THEN DISPLAY "Fake link - do not click" END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A shown ← 'www.mybank.com.au'

B real ← shown

C if real ≠ shown then

D show warning

Question 2

A email ← 'Verify your account'

B real ← hover(email)

C if real = 'bank.com.au' then

D do not log in

Question 3

A click link in the text message

B check the padlock and name

C then log in

Question 4

A name ← 'amazon.com.au'

B seen ← 'amaz0n.com.au'

C if seen ≠ name then safe

Question 5

A link ← 'Win a free phone!'

B real ← hover(link)

C if real is not trusted then

D enter my password

Answer Key

Checking links and fake websites

Section A: Quick Questions

A — The real destination can differ from the shown text, so don't click

B — Hover over the link and read the address that appears

A — paypa1.com

A — Type the website address yourself into the browser

B — www.ato.gov.au

Section B: Match the Pairs

<a href="http://evil-site.com">mybank.com</a> → A link whose shown text says mybank.com but whose real destination is a different, dodgy address

paypa1.com → A look-alike domain name that swaps the letter l for the number 1 to trick you

Hovering over a link shows its real destination in the bottom corner of the browser, so you can check it before clicking → Hover the mouse over: Click here to log in

Typing the address yourself avoids a fake link because you go straight to the real website → https://www.commbank.com.au

Link says: www.myschool.edu.au -> goes to: myschool-login.xyz. Safe, because the text looks right! → Trusting the displayed text without checking the real address, which is a different domain.

www.netflix.account-verify.com is the real Netflix site because it starts with netflix → The real domain is account-verify.com, and netflix is only a subdomain placed at the front to fool you.

Section C: Definitions

Misleading link — A link whose shown text hides a different real web address. Hover to check the address before you click or log in, watch for look-alike names, or type the address yourself.

Section D: Fill in the Blanks

<a href="https://mybank.com.au">Log in</a>

shown ← "mybank.com.au"
real ← "mybank-login.net"
IF real ≠ shown THEN DISPLAY "Fake"

typed ← "https://mybank.com.au"
OPEN(typed)

IF hover_address != "mybank.com.au" THEN
    DISPLAY "Fake link - do not click"
END IF

Section E: Spot the Error

B — The real address must come from hovering over the link, not from the text that is shown. The line should be: real ← hover(link).

C — The test is backwards. You should be warned when the real address does NOT match the bank's address. It should be: if real ≠ 'bank.com.au' then.

A — Typing the address yourself is the safe way to reach a site. Clicking a link in a message could lead to a fake site. It should be: type address into the browser.

C — The seen address has a zero instead of the letter o, so it is a look-alike domain. If the names do not match, the site is fake, not safe.

D — If the real address is not trusted, you should leave the page. You should never enter your password on it. The line should be: leave the page.