200-201 Question 221
Single answerA cybersecurity analyst is investigating a suspicious email that contains a link. Upon inspection, the URL in the email appears as 'http://login-secure.bankexample.com.verify-login.info'. Which feature of this URL suggests that it may be malicious?
- A
The use of 'https' is missing, which makes the URL insecure.
- B
The URL uses a subdomain structure to impersonate a legitimate domain.
- C
The URL contains the word 'secure', which is commonly used in legitimate banking domains.
- D
The top-level domain is '.info', which is less commonly used for legitimate businesses.
Show answer and explanation
Correct answer: B
Explanation
The URL employs a phishing tactic known as domain impersonation by using a subdomain structure ('login-secure.bankexample.com') to make it look like it is associated with 'bankexample.com' when it is actually part of 'verify-login.info'. This technique is designed to deceive users into believing they are accessing a legitimate site.
- A. Incorrect.
The absence of 'https' does not necessarily indicate a malicious URL. Many legitimate websites still use 'http'.
- B. Correct.
The URL uses a deceptive subdomain 'login-secure.bankexample.com' to make it appear as though it belongs to 'bankexample.com', but it is actually part of 'verify-login.info', which is a common tactic in phishing attacks.
- C. Incorrect.
While the word 'secure' is present, it does not guarantee legitimacy, and malicious actors often include such terms to trick users.
- D. Incorrect.
Although '.info' is less commonly used by legitimate entities, the top-level domain alone does not definitively indicate malicious intent.