Malicious Websites
A malicious website is a site that attempts to install malware onto your device. They often look like legitimate websites. Phishing emails can contain links to malicious websites. Being aware of what to look out for will help you protect yourself.
Cyber criminals are increasingly using malicious websites to trick members of the public into believing that they are visiting a genuine website. They have been known to copy genuine websites of Government departments, private investment companies, popular online shops and also the NHS.
Malicious websites can encourage users to download files which contain malware in order to steal the user’s password or the user may be directly asked for payments. These malicious websites use fonts, language, logos, interface and URLs (Uniform Resource Locators) that are very similar to the genuine websites. Links within a message or an email can direct you to a malicious website where cyber criminals can use the information you supply to commit crimes such as identity theft and fraud. It is also possible to be redirected to a fake website, as a result of a water-holing attack.
The Financial Conduct Authority, working with the National Cyber Security Centre, removed over 90 cloned websites, plus 134 UK scam phone lines and 105 associated emails relating to fake firms and cloned websites. The ongoing financial impact of coronavirus (Covid-19) may also make people more susceptible to cloned websites.
Examples of genuine websites faked by cybercriminals
- The NHS COVID-19 web page
- NHS fundraising initiatives such as Captain Tom Moore’s fundraising appeal for ‘NHS Charities Together’
- HMRC
- Online investment scams promoting fake celebrity-endorsed investment opportunities
- Online investment scams imitating genuine investment firms
What to look out for
- A website that automatically asks you to run software or download a file when you’re not expecting to do so.
- A website tells you that your device is infected with malware or that your browser extensions or software are out-of-date.
- A website claims you have won a prize and requests your personal information to claim it.
- Suspicious emails (phishing emails) which include links to malicious websites. A phishing email can appear to come from a trusted person and might look like the sort of correspondence you receive from that person , however it contains a link to a malicious or phishing website.
- Be vigilant and always check for official website addresses and verify social media accounts.
- Check the Uniform Resource Locator (URL), web address of the web page to ensure it is a real site and there are no spelling mistakes.
- Ensure that the website address starts with HTTP and has a lock icon. Websites without a padlock icon are not secure. If the padlock icon is not there, or the browser says not secure, then don’t use the site.
- Browse the website – ensure you double-check the website and the contents on it. Watch out for poor English, such as spelling and grammar mistakes, or phrases that don’t sound quite right.
- Do not click on any links or downloads, enter personal or payment details or create an account on suspicious websites.