Show Yourself
Language: EN

The tricks, one by one

Scammers always use the same handful of tricks. Here they are, each with an example.

RememberThe real domain is read from the right, just before the first single “/”.

  1. The fake beginning

    https://instagram.com.secure-check.info/login

    The brand is at the start, but the part that counts is at the end: secure-check.info. Anyone can write anything before it.

  2. The hidden digit

    https://www.g1thub.com/secure/github

    A digit hides in the name: “g1thub.com” is not GitHub.

  3. The glued letters

    https://zoorn.us/verify

    Letters glued together imitate another one: “rn” looks like “m”, “vv” like “w”, “cl” like “d”.

  4. The foreign letter

    https://microsоft.com/verify

    One letter comes from another alphabet (Cyrillic). It looks identical, but it is a completely different address.

  5. The added word

    https://billing-ebay.info/verify

    Adding a word to a brand (-secure, -login, -support…) creates a different domain that anyone can buy.

  6. The wrong ending

    https://www.coinbase.click/verify

    Right name, wrong ending: the usual address of Coinbase is coinbase.com, not coinbase.click.

  7. The @ trick

    https://adobe.com@safe-access.online/secure/adobe

    Everything before “@” is ignored: this link really goes to safe-access.online.

  8. The free hosting

    https://whatsapp-billing.netlify.app/

    This page lives on a free hosting service, where anyone can get their own address in two minutes. So the whole name counts here: whatsapp-billing.netlify.app.

  9. The address in numbers

    http://126.24.105.28/google/login

    A number address instead of a name: real companies almost never send you there.

  10. The brand in the path

    https://client-portal.online/www.paypal.com/login

    The brand appears after the “/”, in the path: it decides nothing. You really go to client-portal.online.

Practice on links

Disguised attachments

RememberNever trust the icon or the start of the name: only the very last extension counts.

  1. The double extension

    bank_statement.png.js

    Double extension: it pretends to be .png, but it really is .js, a program that runs when opened.

  2. The hidden spaces

    payment_receipt.xlsx ␣×40 .exe

    Spaces push the real extension out of sight: it is actually a .exe program.

  3. The program you did not expect

    setup.exe

    Honest name, but it is a program (.exe): only open it if you were expecting one.

Trapped attachment

I clicked. What now?

  • Only clicked? Close the page. If you typed nothing and opened no file, the risk is low.
  • Typed a password? Change it right away on the official site, and everywhere you use the same one.
  • Gave card or bank details? Call your bank now, using the number printed on your card.
  • Opened a file? Disconnect from the internet, run an antivirus scan and ask someone you trust for help.
  • A child? Tell an adult. Nobody will be angry: it happens to everyone.