28 Dec 2023 · 5 min
Cybercriminals use various techniques to trick users into clicking on malicious or phishing links that can compromise their data and devices. These techniques often involve hiding the real destination of the link behind a seemingly legitimate or harmless one. In this blog, we will explore some of the common methods used by cybercriminals to disguise URLs and how you can protect your business from falling victim to these attacks.
One of the simplest ways to hide the real domain in the address is to use the @ symbol in the URL. This is a valid symbol that can be used to include a login and a password into the website address, such as login:password@domain.com. If the data before the @ symbol is incorrect or not suitable for authentication, the browser simply discards it and redirects the user to the address after the @ symbol.
Cybercriminals use this technique to create a convincing page name, use the name of a legitimate site in it, and place the real address after the @ symbol. For example, look at this address disguised in this way: http://convincing-business-related-page-name-pretending-to-be-on-google.com@kaspersky.com/blog/
It looks like a page with many words in the name hosted somewhere on the Google domain, but the browser will take you to http://kaspersky.com/blog/.
Another way to hide the real domain in the address is to use numbers instead of the IP address. This is done by converting the IP address of a site into an integer, which is more convenient to store in databases. When modern browsers see a number in an URL, they automatically convert it into an IP address.
Cybercriminals use this technique in combination with the @ symbol to make the real address look like a parameter. For example, this is how a link to our corporate website can look like: http://google.com...%@3109359386/
The browser will ignore everything before the @ symbol and take you to http://3109359386/, which is equivalent to http://185.53.178.6/.
A third way to hide the real domain in the address is to use one of the legitimate link shortening services, such as bit.ly, goo.gl, or tinyurl.com. These services allow users to create shorter and more convenient links that redirect to the original ones.
Cybercriminals use these services to mask malicious or phishing links behind seemingly harmless ones. For example, this link http://bit.ly/2G7Z6fj looks like a generic shortened link, but it actually redirects to http://malicious-site.com/.
As you can see, cybercriminals can use various methods to disguise URLs and deceive users into clicking on them. This can lead to data breaches, malware infections, ransomware attacks, identity theft, and other serious consequences for your business. Therefore, it is important to take some preventive measures to protect your business from these threats.
Some of the best practices to avoid falling for disguised URLs are:
If you are looking for a cloud security solution that can help you protect your business from cyber threats, you may want to consider Vinca Cyber. Vinca Cyber is a global cybersecurity services and products company that provides unified visibility across disparate data sources, whether they are in the cloud, on-premises, or on remote devices.
Vinca Cyber offers a comprehensive range of cloud security services, such as:
Vinca Cyber also partners with leading cloud security technologies, such as Netskope, Accops, and Microsoft, to provide you with the best-in-class solutions for your cloud security needs.
Vinca Cyber has a team of experienced and certified cybersecurity experts who can help you achieve 360-degree cyber resilience for your organization. With Vinca Cyber, you can rest assured that your data and applications in the cloud are secure and compliant.
