New Potential Scam Pitfall

[SuperFlyer]

I just saw a new (to me) way that people can scam you:

A legit website, followed by @ then another site, it will go to the second one...
Example: https://google.com@t.ly/lUIOY

So usually it was enough to make sure that the beginning of the url is legit, but it seems no longer enough.

Maybe this has been around a while, but I've never come across it before.

[argo]

Like the link for the British airway flight giveaway?

[SuperFlyer]

Like the link for the British airway flight giveaway?

Well, a recent one yes,
Before it was something like www.britėshairways.com
Note: the second "i"

[SuperFlyer]

Seems like the link was broken

Example: https://google.com@t.ly/lUIOY

[yelped]

I just saw a new (to me) way that people can scam you:

A legit website, followed by @ then another site, it will go to the second one...
Example: https://google.com@T.ly/lUIOY

So usually it was enough to make sure that the beginning of the url is legit, but it seems no longer enough.

Maybe this has been around a while, but I've never come across it before.

That's because you always have to look at the TLD (top level domain). This is just another way of obfuscating the root domain. Just train yourself to always look to the left of the last period and ignore everything else following and preceding.

[SuperFlyer]

That's because you always have to look at the TLD (top level domain). This is just another way of obfuscating the root domain. Just train yourself to always look to the left of the first period and ignore everything else following and preceding.

That was enough, UNTIL now, as I explained.
Click on the link I provided.

[avromie7]

That's because you always have to look at the TLD (top level domain). This is just another way of obfuscating the root domain. Just train yourself to always look to the left of the first period and ignore everything else following and preceding.

This is wrong. You need to look to the left and right of the last period before the /

[SuperFlyer]

This is wrong. You need to look to the left and right of the last period before the /

The right ?
That could be hundreds of characters.
Make sure there is no @ after the /.

[avromie7]

The right ?
That could be hundreds of characters.
Make sure there is no @ after the /.

Incorrect. The first / is always the end of the domain. See my example URL below, this will go to a (non-existent) subdomain of google.com
Https://junk.junk.junk.more.junk.google.com/wastedspace@scam.com

[SuperFlyer]

Incorrect. The first / is always the end of the domain. See my example URL below, this will go to a (non-existent) subdomain of google.com
Https://junk.junk.junk.more.junk.google.com/wastedspace@scam.com

It is what I'm saying.

[AsherO]

I just saw a new (to me) way that people can scam you:

A legit website, followed by @ then another site, it will go to the second one...
Example: https://google.com@T.ly/lUIOY

So usually it was enough to make sure that the beginning of the url is legit, but it seems no longer enough.

Maybe this has been around a while, but I've never come across it before.

What is this @ in URL and why do browsers support it? What's the legit function for it?

ETA: Looks like it's a hack that hijack's the original intent (authority/credentials)

[Euclid]

What is this @ in URL and why do browsers support it? What's the legit function for it?

basic auth I guess?

[AsherO]

basic auth I guess?

That's what it looks like. Looks like they're using siteiwantyoutothinkyou'revisiting.com@malicioussite.com

[yelped]

This is wrong. You need to look to the left and right of the last period before the /

Fixed was a typo. Meant the last.

[SuperFlyer]

What is this @ in URL and why do browsers support it? What's the legit function for it?

ETA: Looks like it's a hack that hijack's the original intent (authority/credentials)

I would think the same way Facebook would link in the following manner:
https://Facebook.com/send/?text=https%3A%2F%2Fwww.facebook.com%2FYechielRiva%2Fposts%2Fpfbid02gHtTxV2D9eeEF2yVULvTB1gKBoh1XRaRx8zV9HjBLRvN2tk3MhUxBhyJ9cxZZwijl&type=custom_url&app_absent=0

[SuperFlyer]

basic auth I guess?

Authenticate what?

The link I posted as an example I created myself and doesn't authenticate anything.

[avromie7]

Fixed was a typo. Meant the last.

Your mistake is not qualifying it as the last before the /.

[yelped]

Your mistake is not qualifying it as the last before the /.

It doesn't have to include a forward slash.

[avromie7]

It doesn't have to include a forward slash.

But if there is one, it ends the domain name.

[SuperFlyer]

But if there is one, it ends the domain name.

You mean the first slash starting after http//: from the left, is the end of the domain name.