How to identify evil websites
There are lots of fake and/or fraudulent websites on the Internet. More and more cyber criminals manage to rip off innocent, unsuspecting people, often by utilizing phishing. It's not a surprise, because according to a McAfee survey, 97% of people are unable to identify phishing emails, which include links that lead to evil sites. Here are several bits of advice that should help you identify emails and websites which are used by hackers to steal your money and/or information.
With phishing, cyber attackers try to get people to disclose confidential information by claiming to represent legitimate commercial entities and websites – banks, for example. And with spear phishing, hackers will target particulars individuals or businesses, trying to install malware on their computers.
The attacker may send a legitimate-looking email that is similar with this one: "Your xyz account has been compromised. Please update your password". Most people will freak out and click the "password update link", which will send them to a page that looks just like the one it's supposed to send them to.
However, if you take a look at the browser's address bar, you will quickly discover that you have landed on a different site. Here's an example that utilizes PayPal: instead of seeing the correct https://www.paypal.com/en/home URL in the browser, you may see something like this: https://www.paypal.com.security/account-recovery3.com. To the untrained eye, the latter URL may look legitimate as well; however, smart people should close the browser windows right away.
Please note that both URLs use the secure HTTPS protocol, so they'll both make your browser display the comforting "Safe" security badge on the left side of the URL bar. Yes, that clever hacker has taken the extra precaution of installing an SSL certificate on his scammy site, with the goal of making you think that you're accessing a legitimate site.
Actually, that green padlock icon only specifies that the site is using the secure HTTPS protocol, so all the data you're exchanging with the phishing website is private. No one (excepting the hacker) will be able to find out your account password and/or credit card information. Not too comforting, I would say...
It goes without saying that you shouldn't have clicked that link in the first place. PayPal will always send emails that include your full name, and will never ask you to update your passwords by clicking links which are included in emails. When in doubt, be sure to contact the service providers by phone, no matter if we are talking about PayPal, your bank, and so on.
Some hackers use link shortening services, which can make dangerous website URLs look pretty. You may get an email which includes a link from Google's popular goo.gl URL shortener service, for example. Links like these may trick your malware detection suite, even though they redirect to dangerous websites. To expand a shortened website URL, use a free online service like this one: http://checkshorturl.com/
Third-party content injection is popular amongst cyber criminals as well. If you've ever tried to access a public hotspot, I am sure that you have noticed the annoying pop-ups, which try to convince you to fill in a form, install a free or trial app, and more. Resist the temptation to click those pop-ups; if you disregard my advice, you will end up installing malware on your device. Actually, any site that's got a lot of ads is suspicious and should be avoided.
Another good idea is to examine each website page carefully, looking for bad English, missing content, etc; most hackers don't take the time to design fully functional websites. Finally, you can check if the website is malicious or not by inputting its URL into an online site tracking database like this one: http://www.hosts-file.net/
