Website quiz, real or fake?

[Jay H 237]

I found this link to McAfee on another board and decided to post it here and we can see how well people do in spotting fake websites and e-mails. This is something we should all look out for.

http://www.siteadvisor.com/quizzes/phishing_0707/

In case you're wondering, I got 6 out of 10 correct. I did worse than I thought I would.

[Kristian Calhoun]

I scored an 8/10. I correctly identified the first eight websites, and then guessed incorrectly on the last two multiple choice questions.

The difference that a couple of poor grammar and formatting errors can make is amazing. Had it not been for those, I probably would have fell for the phony websites as a first time visitor.

Proofreading is key.

[Michelle Celio]

I got 8 of 10.

I missed

• Bank of America
• Amazon

I got an 8 out of 10.

I'm still happy with my home security system though: A paranoid dad who is way to good at network security (co-wrote SSL...), no money to spend, no credit numbers to give away, and a head that actually thinks before acting.

Neat find.

[Grant Cox]

9 out of 10, I missed the first multiple choice (haven't heard of any of the 4 choices, so I took a shot). Some of those sites were unbelievably good though.. the only reason I was able to pick out some of them was because I knew one was fake, so I paid close attention. Chase comes to mind; I probably would've gone ahead and used the fake one, had it been real-life.

[Pavan Dave]

8 of 10. I missed the Paypal one, and I missed the phishing question. The rest I looked at and realized that they were fake by the layout and stuff.

[KTorak]

I kinda blew through it in a hurry, so I missed the ones that weren't completely obvious (IE small typographical errors and stuff like that).

7 out of 10 isn't too bad.

[Billfred]

10/10. I would've missed the Myspace one (as I don't use it), except I noticed the address bars were up on top. Easy.

[Elgin Clock]

7/10

Missed on:
Bank Of America. (Copyright symbol steered me wrong on fake site - lame. The real site should of had one. Seriously.)

Both multiple choices.

Nigerian (never heard of that specific one, nor have I ever gotten it, just lame lotto spoofs., and SSL (should stand for Secure Site License, but obviously as with everything else can be compromised.. Meh.

Good enough for me.

[chris31]

I got 8/10. I dont use sites like Bank of America and Chase, but I got the ones that I have used Amazon, Paypal, etc. Lots of phishing sites are easier to tell than those. I get Paypal phishing spam all the time with bad spelling.

[Schnabel]

I only got a 6/10. As Michelle would say, I fail.

[Phalanx]

This is a good test for everyone to take. You'd be surprised how vulnerable people are without even realizing it.

Now I'm a professional computer systems engineer and I've been involved with internet security, viruses and the like since before PC's were even invented.

I got 9/10 the one I got wrong was the "phising" from sender.

However, my method of verifying a senders address is very different than what they would assume.

I would look at the message header, obtain the origin IP address, then do a
reverse DNS lookup on the IP address to verify that that address belongs to the domain of the sender. I would also look at all the mail relays used along the way and verify them the same way.

If any one test failed, I'd ignore the message.

A really good mail server should do most of that automatically for you.
In fact the last version of Sendmail (8.2.2?) I worked with(3 yrs ago) would allow you to make it requirement for the sending host to have a PTR record (reverse DNS entry) in the DNS and that the host name and domain name of the email all matched. If not the mail would be refused.

Thought I'd share.

[EHaskins]

I was disappointed. I only got 7/10, but I disagree about checking the "From" field. Although spammers/phishers CAN manipulate it, most I've seen don't. It isn't fool proof, but it is a good starting place.

The other ones I got wrong were only because I didn't look carefully, but thats how I am when I'm on the web.

[artdutra04]

9/10. On a school test that wouldn't be a bad grade, but on the Internet that one wrong answer could have compromised my identity.

But just remember. Unless you got a 10/10 when you knew one of the options was a scam, everyone really needs to be more careful online. And saying that "I usually browse safer in the real world" is like saying that "I usually don't speed" when you just got pulled over by the cops. You were caught with your pants down, and making excuses on it doesn't solve anything. All it takes is for everyone to let their guard down for one second to compromise everything.

(Yes, I did get the PayPal email wrong myself, but (pardon this sounding hypocritical to my previous statement) I never use PayPal, and I couldn't check the URL of the link to the login page as the example was just a screenshot. One quick glance to the status bar revealing a website other than https://www.paypal.com/... would have been an instant red flag to me.)

I got the Nigerian 419 and SSL questions right. I know you can spoof SSL certificates if you really want to, and I saw this good video from ABC News about the Nigerian 419 scams last year:
http://www.youtube.com/watch?v=Q0e-pPfITts
http://www.youtube.com/watch?v=2MidGXvrmgE

I also know anything in life that promises a small investment for a large return is either a fake pyramid scheme, or a Nigerian 419 scam. Think about them with common sense; if you have $10 million USD in some 'locked' bank account that could be had for only a few thousand dollars, why wouldn't you just go to a bank and take out a loan for that amount yourself? If there really was $10 million, why would you let some random Joe Schmoe get the money when you'd be able to payback the loan without problems? Duh...

Just use common sense, sound judgment, and always check those links!

[lukevanoort]

I got 10/10, but I really debated a lot on the answers, some of which which I could've gone either way on. The only reason I knew the SSL one was because I get an error message from Firefox whenever I login to password/SSL protected resources at work. Apparently our SSL certificate is out of date or something, but Firefox always tells me that it could be fake.