{"id":13636,"date":"2023-11-02T09:49:25","date_gmt":"2023-11-02T15:49:25","guid":{"rendered":"https:\/\/www.iccu.com\/?p=13636"},"modified":"2025-03-18T09:22:19","modified_gmt":"2025-03-18T15:22:19","slug":"want-to-stay-cyber-safe-know-your-urls","status":"publish","type":"post","link":"https:\/\/www.iccu.com\/blog\/financial-education\/want-to-stay-cyber-safe-know-your-urls\/","title":{"rendered":"Want to Stay Cyber-Safe? Know Your URLs."},"content":{"rendered":"\n

Knowledge isn\u2019t just power anymore \u2014 it\u2019s security. As cyberattacks grow in both number and subtlety, so should your cybersecurity know-how.<\/p>\n\n\n\n

That\u2019s where ICCU comes in. We\u2019re here to show you how to tell the good guys and bad guys apart so you can browse with peace of mind. Up first is one of the most critical parts of any site: the URL. By knowing the anatomy of a URL and what each part does, you\u2019ll be better prepared to make smart, secure decisions online.<\/p>\n\n\n\n

What is a URL?<\/h2>\n\n\n\n

In nerd speak, a URL is a Uniform Resource Locator<\/a>, aka the thing that specifies where resources like webpages are located on the internet. Just like your house has an address to help people find it, each webpage has an address (or URL) to help you find what you\u2019re looking for in the digital world.<\/p>\n\n\n\n

Why do URLs matter in cybersecurity?<\/h2>\n\n\n\n

Fakers create deceptive URLs that closely mimic legitimate sites. At first glance, those URLs can look like the real deal. By recognizing the fakes for what they are, you can avoid falling victim to cyberattacks<\/a> of all kinds.<\/p>\n\n\n\n

(See a high-resolution version of this infographic.)<\/a><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The 3 most important parts of a URL (in terms of cybersecurity<\/h2>\n\n\n\n

There are technically 10 different parts of a URL<\/a>, and all are worth knowing. But when it comes to spotting fakes online, three stand out above the rest: the protocol (or scheme), domain, and subdomain.<\/p>\n\n\n\n

The protocol (or scheme)<\/h3>\n\n\n\n

A URL\u2019s protocol shows you how the webpage you\u2019re visiting was accessed. You may recognize the most common protocols, which are \u2018HTTP\u2019 and \u2018HTTPS.\u2019 (An HTTPS connection is often represented by a lock on the left side of your search bar.)<\/p>\n\n\n\n

Visiting pages that use HTTP is like leaving your house with the door unlocked and the windows wide open. When a page uses HTTP (Hypertext Transfer Protocol), <\/strong>its information, like browsing data and web content, are transmitted in plain text, which hackers can easily access. When a page uses HTTPS (Hypertext Transfer Protocol Secure<\/em>), <\/strong>its data is encrypted as it\u2019s transmitted, providing you with a higher level of security and privacy.<\/p>\n\n\n\n

What to watch for<\/h4>\n\n\n\n

Most sites you access on a day-to-day basis use HTTPS because it\u2019s industry standard. Many browsers show a lock icon at the beginning of the URL to denote an HTTPS connection. Steer clear of HTTP protocols when possible, particularly when submitting sensitive information (including logins) or making online transactions. Even if the HTTP site is legitimate, its weak protocol makes it more vulnerable to cyberattacks.<\/p>\n\n\n\n

You may occasionally run into other protocols, like \u2018FTP,\u2019 \u2018SFTP,\u2019 or \u2018mailto.\u2019 Of these, SFTP is the safest \u2014 the \u2018S\u2019 here also stands for \u2018secure.\u2019 If you see a protocol you don\u2019t recognize, proceed with caution. You may still be on a legitimate site but keep that info in your back pocket just in case. If you see other red flags (like typos, unsolicited requests for payments, etc.), leave the site immediately.<\/p>\n\n\n\n

The domain and subdomain<\/h3>\n\n\n\n

If a URL is like your home address, the domain<\/strong> is like your home itself. It tells people which site they\u2019re visiting. ICCU\u2019s domain, for example, is the \u2018iccu\u2019<\/strong> in iccu.com<\/a>. Domains can only be registered to one entity (person or company), so they\u2019re a pretty reliable way to tell if you\u2019re on a trusted site.<\/p>\n\n\n\n

A subdomain<\/strong>, on the other hand, is more like a room in your home. It goes right before the domain (separated by a period) and shows that you\u2019re visiting a specific section of a website. When you log in to your eBranch account online, for example, you\u2019ll see this URL: https:\/\/myebranch.iccu.com\/Authentication<\/a>. The domain is still ‘iccu,’ which shows that you\u2019re still on our site, not a scammer\u2019s dupe. The subdomain, \u2018myebranch,\u2019 shows that you\u2019re on the Online Banking section of our site.<\/p>\n\n\n\n

(Read: What Scammers Don\u2019t Want You to Know)<\/a><\/em><\/p>\n\n\n\n

What to watch for<\/h4>\n\n\n\n

Since fraudsters can\u2019t use a company\u2019s actual domain on their fake site, they use slight variations instead. If you pay careful attention to the domain and subdomain, though, you can spot the difference easily. Here are a few examples of fake <\/strong>ICCU sites:<\/p>\n\n\n\n