# A fake site can copy everything except its address.

Staying a step ahead · 04 · 11 min read

A copied page can reproduce the logo, wording, and sign-in form. The useful evidence lives outside
the page itself: the address your browser is visiting and the route you used to get there.

This page helps you:

- Read a web address to see which site you are on
- Recognize the tricks look-alike addresses use
- Check a site when there is no address bar to read

> A copied page can look exactly right. What it cannot copy is the address it lives at, or the route
> you took to reach it.

When a page asks for a password or payment, its polish cannot tell you who runs it. Look at the
hostname in the address bar and compare it with the exact domain you expected. If the ending is
unfamiliar or hard to read, leave and open the service through its app, a saved bookmark, or an
address you already know.

## The hostname tells your browser which site to contact.

Start with the exact domain you expected, here `northstar.example`. Select this address to see why a
familiar name elsewhere in the address is not enough.

**About these addresses:** Every address on this page is made up. They end in .example instead of
.com, because .example is set aside for examples and can never belong to a real site. Real addresses
end in .com, .org, .co.uk, and many others. You read them the same way.

```
Sign in
https://login.northstar.account-verify.example/signin
```

The full hostname is login.northstar.account-verify.example. In this simple example, the controlling
domain at its right-hand end is account-verify.example, not northstar.example. The words to its left
are subdomains chosen by whoever controls account-verify.example. On the service you meant to reach,
the domain would be northstar.example. This is a deliberately simple example, not a universal "last
two parts" rule. Real endings such as co.uk contain more than one part. When the comparison is not
immediately clear, leave and reach the service through a route you already trust.

Illustrative address. Many phone browsers and apps let you press and hold a link to preview its
destination before tapping.

Reviewed July 2026. References:
[IANA on reserved example domains](https://www.iana.org/domains/reserved) ·
[Public Suffix List on why domain endings vary](https://publicsuffix.org/learn/).

## Unlearn this

HTTPS encrypts the connection. It does not tell you whether the site belongs to the company you
meant to reach.

Many people were taught to “look for the padlock.” Some browsers no longer show one because it was
so often mistaken for a trust mark. When a browser shows HTTPS, it means the connection to that
hostname is encrypted. A copied login page can use HTTPS too. Check the domain or open the service
through a route you trust. Chrome explains its lock-icon change in
[this browser-security note](https://blog.chromium.org/2023/05/an-update-on-lock-icon.html).

## Three ways a real name gets faked

- A familiar name can sit on the left without controlling the site. In northstar.secure-id.example,
  the domain is secure-id.example. “northstar” is a subdomain chosen by whoever controls it.
- Two ordinary letters can merge at a glance. Here, “r” and “n” imitate “m”. Substituting a zero for
  an O or a 1 for a lowercase l uses the same weakness in quick reading.
- Adding “support” creates a separate domain, not a support section of the expected one. A real
  support page could use support.harbor.example, with the expected domain intact at the end.

## Read an address from its right-hand end.

Choose an address, then move through it one part at a time, starting from the right. On a real
address with an unfamiliar country or organizational ending, use the service's app or a bookmark
instead of trying to solve it at a glance.

### Example 1

```
You meant to reach northstar.example
https://login.northstar.example/account
```

- The ending: Start where the hostname stops, just before the first single slash. The ending here is
  .example. On real sites it could be .com, .org, or a country ending such as .co.uk, which has two
  parts.
- The name before it: Together with the name directly before it, the ending makes the domain:
  northstar.example. That is the domain you expected, so this address belongs to the service you
  meant to reach.
- Words to the left: "login" sits to the left of the domain. Words here are subdomains, chosen by
  whoever controls northstar.example. Because the domain is the one you expected, this is a section
  of the real service.
- After the slash: Everything after the first single slash is the path: a page inside the site the
  domain names. It never changes who runs the site.

```
Domain: northstar.example. This is the domain you expected.
```

### Example 2

```
You meant to reach northstar.example
https://northstar.shipping-update.example/track
```

- The ending: Start where the hostname stops, just before the first single slash. The ending here is
  .example, the same ending the real domain uses, so the ending alone settles nothing.
- The name before it: The name directly before the ending is shipping-update, so the domain is
  shipping-update.example. That is not northstar.example, even though the familiar name appears in
  the address.
- Words to the left: "northstar" sits to the left of the domain, where anyone who controls
  shipping-update.example can put any word they like. A familiar name here does not make it
  Northstar's site.
- After the slash: The path names a page inside shipping-update.example. It does not move the site
  anywhere else.

```
Domain: shipping-update.example. This is not northstar.example. Leave and use a route you already trust.
```

### Example 3

```
You meant to reach northstar.example
https://northstar-support.example/help
```

- The ending: Start where the hostname stops, just before the first single slash. The ending here is
  .example.
- The name before it: The name directly before the ending is northstar-support, so the domain is
  northstar-support.example. A hyphen joins words into one name. This is a separate domain from
  northstar.example, not its support page.
- Words to the left: Nothing sits to the left of the domain in this address. The whole hostname is
  northstar-support.example. A real support page would more likely keep the expected domain intact,
  as in support.northstar.example.
- After the slash: The path names a page inside northstar-support.example. It does not connect the
  site to Northstar.

```
Domain: northstar-support.example. This is not northstar.example. Leave and use a route you already trust.
```

### Example 4

```
You meant to reach northstar.example
https://northstar.com-account-verify.example/northstar.example/signin
```

- The ending: Start where the hostname stops, just before the first single slash. The ending here is
  .example. A ".com" further left can look like an ending at a glance, but the hostname does not
  stop there.
- The name before it: The name directly before the ending is com-account-verify, so the domain is
  com-account-verify.example. The ".com" you may have noticed is not an ending. It sits further
  left, and the hyphen after it makes it part of another name.
- Words to the left: "northstar" sits to the left of the domain, chosen by whoever controls
  com-account-verify.example. Read quickly, "northstar.com" can look like a complete address, which
  is why reading from the right helps.
- After the slash: This path even contains northstar.example. It is still only a page inside
  com-account-verify.example. A familiar name after the slash says nothing about who runs the site.

```
Domain: com-account-verify.example. This is not northstar.example. Leave and use a route you already trust.
```

## When there's no address bar to read

Reading the address only works when you can see it. A link in a text or email can show friendly
words instead of its destination. A page opened inside an app may hide the address bar, and a QR
code conceals its destination until another device interprets it. In each case, reach the service
independently before entering a password or payment detail.

Many phone browsers and apps let you press and hold a link to preview its destination before you
tap. Better still, don't follow the link at all: open the site the way you normally would, by
bookmark or by typing it, or open the company's own app. If you already typed a password into a page
you now doubt, change it through the real service and review where the account is signed in. See
[I clicked a link](https://explained.withpersona.com/your-identity-online/clicked-a-link) and
[recovering an account](https://explained.withpersona.com/your-identity-online/account-taken-over).

## Sometimes the real site looks a little odd too.

Real companies use extra domains for logins and payments, so you might genuinely land on a name you
don't recognize mid-checkout. An unfamiliar address is a reason to stop, not proof by itself. Back
out and reach the site your usual way.

Some fakes use characters from another writing system that look identical to familiar letters, so an
address can look right while pointing somewhere else. No visual check catches every case. A
bookmark, your
[password manager](https://explained.withpersona.com/your-identity-online/password-managers)'s
autofill, or a passkey ties the sign-in to a route or service you established earlier.

**How it looks is not who runs it**

How the address looks · Who actually runs it

- Looks right · Real · The real site: A bookmark, autofill, or passkey confirms it without relying
  on how it looks.
- Looks right · Fake · A look-alike that fools the eye: Characters from another writing system can
  look identical to familiar letters.
- Looks odd · Real · An unfamiliar but real domain: Real companies use extra domains for logins and
  payments. It is a reason to stop, not proof.
- Looks odd · Fake · A fake you can spot: Back out and reach the site your usual way.

No visual check catches every case. A route you established earlier covers the two cases that fool
the eye.

## Where fakes come from

**Where fakes come from, and the way around each**

- **A link in a text or email**
  - The route it hands you: Friendly words that hide the destination
  - A route you already trust: A saved bookmark, an address you type, or the company's own app
- **A page opened inside an app**
  - The route it hands you: A page with the address bar hidden
  - A route you already trust: Reach the service independently before entering a password or payment
    detail
- **A QR code on a poster or meter**
  - The route it hands you: A destination hidden until another device reads it
  - A route you already trust: An address you know or a saved bookmark
- **A sponsored search result**
  - The route it hands you: The result at the top of the search
  - A route you already trust: A saved bookmark or the app you already trust
- **A pop-up or ad with a support number**
  - The route it hands you: The number it displays
  - A route you already trust: Support inside the company's app, or on the site you reach yourself

The habit is the same every time: don't use the route they gave you.

One trap deserves its own warning. A pop-up or sponsored result can display a misleading support
number. Do not trust the number because it appears above other results. Find support inside the
company's app or on the site you reach through an address or bookmark you already trust.

The [FTC](https://consumer.ftc.gov/consumer-alerts/2025/04/online-search-results-good-bad-scammy)
also warns about fake support numbers in paid search results, and its guidance suggests typing a
company's address yourself.

## Routes that do not depend on reading the address

1. Bookmark the sites where you log in or pay, and use the bookmark. It reduces the chance of
   following a look-alike link or ad.
2. Your [password manager](https://explained.withpersona.com/your-identity-online/password-managers)
   can provide another signal. Managers associate saved logins with sites, though their matching
   rules vary. If autofill is unexpectedly silent, pause and check the address rather than treating
   that silence as proof.
3. A correctly implemented passkey is bound to a particular service, which makes it resistant to
   look-alike-site phishing. Availability and recovery still depend on the service. See
   [two-factor & passkeys](https://explained.withpersona.com/your-identity-online/two-factor).

---

_Part of Identity Explained (by Persona).
https://explained.withpersona.com/your-identity-online/fake-sites_