Website quiz, real or fake?

[Jay H 237]

I found this link to McAfee on another board and decided to post it here and we can see how well people do in spotting fake websites and e-mails. This is something we should all look out for.

http://www.siteadvisor.com/quizzes/phishing_0707/

In case you're wondering, I got 6 out of 10 correct. I did worse than I thought I would.

[Kristian Calhoun]

I scored an 8/10. I correctly identified the first eight websites, and then guessed incorrectly on the last two multiple choice questions.

The difference that a couple of poor grammar and formatting errors can make is amazing. Had it not been for those, I probably would have fell for the phony websites as a first time visitor.

Proofreading is key.

I got an 8 out of 10.

I'm still happy with my home security system though: A paranoid dad who is way to good at network security (co-wrote SSL...), no money to spend, no credit numbers to give away, and a head that actually thinks before acting.

Neat find.

[Michelle Celio]

I got 8 of 10.

I missed

• Bank of America
• Amazon

[Grant Cox]

9 out of 10, I missed the first multiple choice (haven't heard of any of the 4 choices, so I took a shot). Some of those sites were unbelievably good though.. the only reason I was able to pick out some of them was because I knew one was fake, so I paid close attention. Chase comes to mind; I probably would've gone ahead and used the fake one, had it been real-life.

[Pavan Dave]

8 of 10. I missed the Paypal one, and I missed the phishing question. The rest I looked at and realized that they were fake by the layout and stuff.

[KTorak]

I kinda blew through it in a hurry, so I missed the ones that weren't completely obvious (IE small typographical errors and stuff like that).

7 out of 10 isn't too bad.

[Billfred]

10/10. I would've missed the Myspace one (as I don't use it), except I noticed the address bars were up on top. Easy.

[Elgin Clock]

7/10

Missed on:
Bank Of America. (Copyright symbol steered me wrong on fake site - lame. The real site should of had one. Seriously.)

Both multiple choices.

Nigerian (never heard of that specific one, nor have I ever gotten it, just lame lotto spoofs., and SSL (should stand for Secure Site License, but obviously as with everything else can be compromised.. Meh.

Good enough for me.

[chris31]

I got 8/10. I dont use sites like Bank of America and Chase, but I got the ones that I have used Amazon, Paypal, etc. Lots of phishing sites are easier to tell than those. I get Paypal phishing spam all the time with bad spelling.

[Schnabel]

I only got a 6/10. As Michelle would say, I fail.

[Phalanx]

This is a good test for everyone to take. You'd be surprised how vulnerable people are without even realizing it.

Now I'm a professional computer systems engineer and I've been involved with internet security, viruses and the like since before PC's were even invented.

I got 9/10 the one I got wrong was the "phising" from sender.

However, my method of verifying a senders address is very different than what they would assume.

I would look at the message header, obtain the origin IP address, then do a
reverse DNS lookup on the IP address to verify that that address belongs to the domain of the sender. I would also look at all the mail relays used along the way and verify them the same way.

If any one test failed, I'd ignore the message.

A really good mail server should do most of that automatically for you.
In fact the last version of Sendmail (8.2.2?) I worked with(3 yrs ago) would allow you to make it requirement for the sending host to have a PTR record (reverse DNS entry) in the DNS and that the host name and domain name of the email all matched. If not the mail would be refused.

Thought I'd share.

[EHaskins]

I was disappointed. I only got 7/10, but I disagree about checking the "From" field. Although spammers/phishers CAN manipulate it, most I've seen don't. It isn't fool proof, but it is a good starting place.

The other ones I got wrong were only because I didn't look carefully, but thats how I am when I'm on the web.