200-201 Question 312
Single answerA security analyst is investigating a phishing attack where an employee received an email that directed them to enter sensitive information on a fraudulent website. Upon inspecting the URL in the phishing email, the analyst observes the following: 'http://secure-login.companyname-security.com'. Based on this information, what is the most likely indicator that this URL is malicious?
- A
The URL uses 'http://' instead of 'https://'.
- B
The domain includes 'secure-login', which is a common term used in phishing attacks.
- C
The domain includes 'companyname-security.com', which does not match the official corporate domain.
- D
The URL length is unusually long, which is a common characteristic of phishing websites.
Show answer and explanation
Correct answer: C
Explanation
The domain 'companyname-security.com' is a clear sign of a malicious URL because it mimics the legitimate company's domain while adding misleading terms. Attackers often use such tactics to deceive users into believing the URL is legitimate. Other indicators, such as the use of 'http' or common phishing terms, are supporting clues but are not as definitive without the domain mismatch.
- A. Incorrect.
While 'http://' is less secure than 'https://', some legitimate websites may still use 'http'. This alone is not conclusive evidence of a malicious URL.
- B. Incorrect.
'secure-login' is a common term in phishing URLs, but its presence alone is not definitive proof of malicious intent without additional context.
- C. Correct.
The domain 'companyname-security.com' is designed to look similar to the legitimate corporate domain but is actually different. This is a clear indicator of a phishing attempt.
- D. Incorrect.
A long URL can sometimes indicate malicious intent, but it is not a definitive indicator. Many legitimate URLs can also be lengthy, depending on the structure of the website.