Module 3 · 3.2
English
Reading domains and links
Module 3: Recognising phishing · Reading time: 13 minutes
Learning objective: After this lesson you can work out the real destination of any link: you can find the registrable domain using the public suffix list and recognise subdomain, path and @ tricks, lookalikes, punycode, shorteners and open redirects.
Key concepts: URL, scheme, host, registrable domain, public suffix, subdomain, path, lookalike, typosquatting, homograph, punycode (xn--), URL shortener, open redirect
The parts of a link
A web address is called a URL. It consists of fixed parts:
https://inlog.mijnbank.example:443/klant/overzicht?taal=nl#saldo| Part | In this example | What it does |
|---|---|---|
| Scheme | https | How the browser makes the connection |
| Host | inlog.mijnbank.example | Which server you're talking to |
| Port (rarely visible) | 443 | The "door number" on that server |
| Path | /klant/overzicht | Which page on that server |
| Query | ?taal=nl | Extra data for the page |
| Fragment | #saldo | A spot on the page |
The host is the only part that determines who owns the site. The path, query and fragment are chosen by the owner of that host. So they can contain anything, including the name of another organisation.
You read the host from right to left, label by label. The end is the most important part.
The registrable domain and the public suffix list
It's not the whole host that tells you who the owner is, but one part of it: the registrable domain. That's the name someone has registered with a registrar. Everything to the left of it is a subdomain, and the owner can create as many of those as they like.
To find the registrable domain, you need to know where you can actually register a name yourself. That part is called a public suffix. Examples include com, nl and example, but also co.uk: in the United Kingdom, a business registers a name under co.uk. The registrable domain is then the public suffix plus one label in front of it.
| Host | Public suffix | Registrable domain |
|---|---|---|
www.example.com | com | example.com |
inlog.mijnbank.example | example | mijnbank.example |
www.shop.[name].co.uk | co.uk | [name].co.uk |
mijnbank.co.uk.example | example | uk.example |
So the rule of thumb "take the last two parts" is wrong. With www.shop.[name].co.uk you'd get co.uk, which doesn't belong to anyone in particular. And the last example shows that co.uk in the middle of a name means nothing: there, uk.example is the owner.
Which suffixes are public is listed in the Public Suffix List (publicsuffix.org), a list started by Mozilla and now maintained by the community. Browsers use it, among other things, to decide which sites are allowed to share cookies and to highlight the important part of an address. The list also has a section for "private" suffixes: services where customers get their own subdomain, such as some blog and project page hosting services. Each customer under one of these counts as a separate owner.
If a suffix isn't in the list, the default rule applies: the last label is the suffix. That's why, for .example, the registrable domain is always the last two labels.
Tricks with subdomain, path and @
Now that you know where the owner's name appears, you can see how attackers mislead your eyes. They place the name you expect somewhere else in the link.
Subdomain trick.
https://mijnbank.example.inlog-check.example/loginYou see mijnbank.example at the front. But read from the right: the suffix is example, the registrable domain is inlog-check.example, and that belongs to the attacker. The attacker bought that domain and put the subdomain mijnbank.example in front of it themselves.
Path trick.
https://inlog.example/mijnbank.example/klant/loginThe host is inlog.example and nothing more. Everything after the first single / is the path, and the owner of inlog.example chooses that themselves.
@ trick.
https://mijnbank.example@aanvaller.example/inloggenA URL may contain a userinfo part before the host, ending with @ (the URL standard, RFC 3986, calls this userinfo). So everything before the @ is not the host. The browser goes to aanvaller.example and nowhere else. Some browsers warn about this or strip out the userinfo part, but don't rely on that.
A handy fixed method: find the first / after https://. What comes before it is the host (possibly with a userinfo part and @). If there's an @, the host only starts after it. Read the host from right to left until you have the registrable domain.
Lookalikes, typosquatting and punycode
A lookalike is a domain of its own that resembles someone else's:
| Lookalike | Trick |
|---|---|
rnijnbank.example | rn looks like m in many fonts |
mijnbnak.example | two letters swapped (typosquatting: betting on a typo) |
mijnbank-veilig.example | an extra word with a hyphen: a completely different domain |
mijnbank-example.example | the dot replaced by a hyphen |
mijnbank.example.inlog-check.example | the real domain used as a subdomain (see above) |
A step further is the homograph: a domain with letters from a different script that look the same. The Cyrillic а looks like the Latin a, but is a different character to a computer. Domain names with such characters are called internationalised domain names. The DNS only recognises the letters a to z, digits and the hyphen, so such a name is converted to punycode (RFC 3492): a form that starts with xn--.
mijnbаnk.example (with a Cyrillic а)
xn--mijnbnk-6fg.example (the same name in punycode)If you see xn-- in an address, that name contains characters outside a to z. This can be completely normal (many languages have accents or their own script), but in a name that otherwise looks Dutch or English, it's a strong warning sign. Browsers have rules to display suspicious combinations as punycode; Chrome, for example, shows a label with mixed Latin and Cyrillic script as xn--. But these rules don't catch everything, and in an email or chat you often simply see the neat-looking letters.
Shorteners and open redirects
URL shorteners turn a long link into a short one, such as https://kort.example/a8Xk2. Handy, but you can't see the destination. The registrable domain of the link belongs to the shortener, not to the organisation you expect. If a bank or supplier asks you to log in via a shortened link: don't.
An open redirect is a page on a genuine site that sends visitors on to whatever address is included in the link:
https://mijnbank.example/doorsturen?naar=https://aanvaller.example/inloggenThe host really is mijnbank.example, but after one click you end up on aanvaller.example without noticing. A shortener or a tracking link from a newsletter service can also take you somewhere other than the first domain. The lesson: check the address bar again after clicking, before you fill anything in. And the padlock? That only tells you the connection is encrypted. Fake sites can have a valid certificate too.
In practice: what it looks like
On a computer, hover your mouse over a link without clicking; the real destination appears in the bottom left of the window or in a pop-up. This also works in most email programs and webmail. On a phone, press and hold the link: you'll get a menu with the address shown above it. Don't choose "open".
Watch out for two pitfalls:
- The visible text isn't the destination. An email button or text might show
https://mijnbank.example, while the link underneath goes to a completely different address. Only what you see when hovering or pressing and holding counts. - Long addresses get cut off. Phones often only show the beginning. The important part at the end is exactly what disappears. Scroll or tap in the address to see it in full.
If in doubt, type the address you know yourself or use your bookmark. The NCSC also refers to checkjelinkje.nl (Dutch tool) to have a link checked first.
Summary
- Only the host determines who owns a site. The path, query and anything before an
@is chosen by the attacker. - The registrable domain is the public suffix plus one label. Use the Public Suffix List, not "the last two parts" (think of
co.uk). - Read the host from right to left. Having the real domain appear at the front as a subdomain is a classic trick.
- Lookalikes: swapped letters, extra words, homographs.
xn--means characters outside a to z. - Shorteners hide the destination, open redirects forward you elsewhere. Check the address bar again after clicking.
Quiz
Exercise
Exercise A3.2: Finding the registrable domain. You'll be given eight links. For each link, fill in the registrable domain and indicate whether the link matches the genuine organisation. The programme checks your answer using the Public Suffix List.
Exercise A3.2b: Tricky links. Eight links with @ tricks, punycode, shorteners and forwarding pages. For each link, fill in which domain you end up on, or choose "can't tell".
Further reading
The steps in the WebOké articles apply to the WebOké environment; with other providers it works in a similar way.
- Is this email really from WebOké? Recognizing phishing and using the promo code
- DNS course, about domain names and how to read them: https://www.weboke.pl/en/dns-cursus
- NCSC, Spoofing: https://www.ncsc.nl/phishing/spoofing
- Public Suffix List: https://publicsuffix.org/
- RFC 3986, the structure of a URL (including userinfo): https://www.rfc-editor.org/rfc/rfc3986
- RFC 3492, Punycode: https://www.rfc-editor.org/rfc/rfc3492
- Chromium, when the browser shows an internationalised name as punycode: https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md