What this is about
Scammers build addresses that look like your bank's at first glance. In six rounds you pick the one address that really belongs to the company — and see why the others don't.
What you practise
Find the part of a web address that matters: what comes right before the ending.
The one rule: read from the right
A web address belongs to whoever owns the part right before the ending (.com, .org, .uk …). Where the address ends is marked by the first “/”, “?” or “#” after “https://”. Everything further left is set by the owner of that address — who can put your bank's name there, too. With two-part endings such as .co.uk, it's the word before .co.uk that counts.
https://kestrelmoorbank.example.secure-signin.example/login
Here the page belongs to secure-signin.example. The bank name is only camouflage at the front. A popular variant follows the pattern bankname.com-‹anything›.net: the “.com” at the front is not the ending — the page belongs to “com-‹anything›.net”.
In this exercise all addresses end in .example or .test — endings reserved for examples, so no real company is affected. Which of the two an address has says nothing about genuine or fake.
Where the rule ends
The rule tells you who owns an address — not whether you can trust the message.
- Big platforms: on many well-known services, anyone can create forms, shared documents and small web pages. Then the platform's real address stands before the ending — but the content still comes from strangers.
- Real sender, bad intent: hacked accounts and genuine mailing services get misused, too. The address then fits — a request for money, passwords or codes is still suspicious.
- Short links and QR codes only show where they lead once you open them.
- Foreign address, real company: some companies send their emails through mailing services. So a foreign link target alone doesn't prove a trap — it only makes the email unclear.
That's why, whenever money, passwords or codes are involved: open it yourself — the app, a bookmark or an address you type in.
The interactive exercise needs JavaScript. Without it, you can read through all messages with their explanations here.
Which address really belongs to Kestrelmoor Bank (kestrelmoorbank.example)?
https://kestrelmoorbank.example.secure-signin.example/login– ✗ This address belongs to secure-signin.example. The bank's name at the front is just camouflage.https://kestrelmoor-online.example– ✗ kestrelmoor-online.example is its own address. Adding a word turns it into something else.https://kestrelmoorbank.example/online-banking/sign-in– ✓ Before the first slash comes kestrelmoorbank.example — the bank's address. Whatever follows the slash changes nothing.https://kestrelmoorbank.example-login.example/sign-in– ✗ After “kestrelmoorbank.” it continues with “example-login.example”. The address belongs to example-login.example.
First find the end of the address: after “https://”, up to the first “/”, “?” or “#”. What counts is the ending and the word directly in front of it.
Which address belongs to ParcelGull (parcelgull.test)?
https://parcellgull.test/track– ✗ Look closely: “parcellgull” with a double l. A typo name that looks the same at first glance.https://parcelgul.test/track– ✗ An l is missing: “parcelgul”. Also a different address.https://parcelgull.test.tracking-service.test– ✗ The address belongs to tracking-service.test — the parcel service's name only appears at the front.https://www.parcelgull.test/tracking– ✓ Spelled correctly and right before the slash: parcelgull.test. The “www.” in front changes nothing.
Typo addresses hardly stand out when you read quickly. For important sites like your bank or parcel service: create a bookmark and only open them from there.
Which address belongs to Flickerhaven (flickerhaven.example)?
https://flickerhaven.help-centre.example/account– ✗ The address belongs to help-centre.example.https://help.flickerhaven.example– ✓ Something may come before (“help.”, “www.”). What matters is that it ends in flickerhaven.example — a path after it isn't needed.https://flickerhaven-help.example– ✗ flickerhaven-help.example is its own address.https://www.flickerhaven.example.account-check.example/help– ✗ At the end it says account-check.example — that's who owns the page.
Things may change to the left of the company name (www., help., account.). After the company name, only the ending may follow.
An email promises a voucher from Ploverbury Market (ploverbury.test). Which address really belongs to the supermarket?
https://ploverbury-voucher.test/offers– ✗ ploverbury-voucher.test — a different name, a different address.https://voucher.ploverbury.test.promo.test– ✗ Everything before promo.test is decoration. The page belongs to promo.test.https://ploverbury.test.prize.test– ✗ The address belongs to prize.test.https://www.ploverbury.test/offers/vouchers– ✓ ploverbury.test right before the slash — that's the supermarket.
The more dots, the closer you should look: fake addresses stack familiar names at the front so the ending gets lost.
Which address really leads to Tidewren Mobile (tidewren.test)?
https://tidewren.test@bill-online.test/login– ✗ Careful, @ sign before the first slash: the browser ignores everything before it. This address leads to bill-online.test.https://account.tidewren.test/bills– ✓ “account.” at the front, tidewren.test right before the slash — that's your provider.https://tidewren.test.bill-online.test– ✗ The page belongs to bill-online.test.https://tidewren-bill.test/login– ✗ tidewren-bill.test is its own address.
An @ before the first slash is a warning sign: the browser jumps to whatever comes after it. After the slash an @ is harmless — for example in channel addresses on video sites.
Your browser shows these addresses. Which one is the real Kestrelmoor Bank?
https://xn--kestrelmoorbnk-6tl.example/login– ✗ “xn--” means special characters are hidden in the name — here a Cyrillic “а” that looks like a Latin a. Some browsers show this spelling and give the trick away; don't rely on it.https://kestrelmoorbank.example/login– ✓ Only ordinary letters, kestrelmoorbank.example before the slash.https://login.kestrelmoorbank.example.account-check.example– ✗ Ordinary letters, but at the end it says account-check.example — the page doesn't belong to the bank.
In an email, “kestrelmoorbаnk.example” with a Cyrillic а looks exactly like “kestrelmoorbank.example” — you can't tell by eye. “xn--” in the address bar is a hint, not proof: addresses with accented letters are written this way too. So open bank and shop sites from a bookmark.
All companies, people, addresses and numbers in the exercises are invented. Any resemblance to real companies or people would be purely coincidental and unintended.