3 ms·

This article links to a story about someone almost falling for the scam involving a fake AirBnb site: > Then we noticed that the URL of the listing was a littl

This article links to a story about someone almost falling for the scam involving a fake AirBnb site: > Then we noticed that the URL of the listing was a little bit off. It showed “www.airbnb.com-request-booking.space/booking/…”. We were a bit confused by this, but as the URL started with “www.airbnb.com” I figured there was no way it could be a SPAM site. https://www.goatsontheroad.com/airbnb-scam/ https://www.goatsontheroad.com/airbnb-scam/ This high level description fails to identify the server name part of the url and they don’t get to it later on in the article. It should be internet 101, but apparently it isn’t. If they understood the server name part of the url they’d know exactly why that url isn’t on airbnb.com and AirBnb has no control over it. On the positive side, if they miss this, they are likely not getting scammed because they’re desperate. I’m sure that’s why some get scammed but certainly not all of them. I don’t think wishing for something that’s too good to be true is the biggest reason people get scammed.

baroffoos 8y ago
Problem is hardly anyone knows how a url and domain name work which makes sense because they follow some rules that are simple but not obvious without education. This is made worse by the fact that many companies use 100 different domain names so the legit websites are impossible to tell from scams
- SlowRobotAhead 8y ago
  >This is made worse by the fact that many companies use 100 different domain names so the legit websites are impossible to tell from scams Ugh. The worst. I have to explain weekly that microsoftonline.com is fine, az.co is really amazon, why things like amazon.training are legit, what x.co or other link shorteners are, and that only the last . matters and the letters immediately before and after that. It’s a bad system, made worse by people that should know better.
  - whoopdedo 8y ago
    The people that should know better are, I'm afraid, us. I recall many complaints a few months ago when the idea was floated for Chrome to not show the URL in the location bar but instead display the organization name from the SSL certificate.
    - benatkin 8y ago
      That would give the EV Certificate vendors, who have shown many times they can't be trusted, too much power, and turn the web into a walled garden, or it would be useless. Take your pick.
eli 8y ago
"Look carefully at the URL" has never been a legitimate solution for phishing. And it's completely unfair to use it as a way to blame users.
- deleted 8y ago
  [deleted]

baroffoos 8y ago

Problem is hardly anyone knows how a url and domain name work which makes sense because they follow some rules that are simple but not obvious without education. This is made worse by the fact that many companies use 100 different domain names so the legit websites are impossible to tell from scams

SlowRobotAhead 8y ago
>This is made worse by the fact that many companies use 100 different domain names so the legit websites are impossible to tell from scams Ugh. The worst. I have to explain weekly that microsoftonline.com is fine, az.co is really amazon, why things like amazon.training are legit, what x.co or other link shorteners are, and that only the last . matters and the letters immediately before and after that. It’s a bad system, made worse by people that should know better.
- whoopdedo 8y ago
  The people that should know better are, I'm afraid, us. I recall many complaints a few months ago when the idea was floated for Chrome to not show the URL in the location bar but instead display the organization name from the SSL certificate.
  - benatkin 8y ago
    That would give the EV Certificate vendors, who have shown many times they can't be trusted, too much power, and turn the web into a walled garden, or it would be useless. Take your pick.

eli 8y ago

"Look carefully at the URL" has never been a legitimate solution for phishing. And it's completely unfair to use it as a way to blame users.

deleted 8y ago
[deleted]