Malicious Websites
A malicious website is a site that attempts to install malware onto your device. They often look like legitimate websites. Phishing emails can contain links to malicious websites. Being aware of what to look out for will help you protect yourself.
Cyber criminals are increasingly using malicious websites to trick members of
the public into believing that they are visiting a genuine website. They have
been known to copy genuine websites of Government departments, private investment
companies, popular online shops and also the NHS.
Malicious websites can encourage users to download files which contain malware
in order to steal the user’s password or the user may be directly asked for
payments. These malicious websites use fonts, language, logos, interface and
URLs (Uniform Resource Locators) that are very similar to the genuine websites.
Links within a message or an email can direct you to a malicious website where
cyber criminals can use the information you supply to commit crimes such as
identity theft and fraud. It is also possible to be redirected to a fake website,
as a result of a
water-holing
attack.
The Financial Conduct Authority, working with the
National Cyber Security Centre
,
removed over 90 cloned websites, plus 134 UK scam phone lines and 105 associated
emails relating to fake firms and cloned websites. The ongoing financial impact
of coronavirus (Covid-19) may also make people more susceptible to cloned websites.
Examples of genuine websites faked by cybercriminals
- The NHS COVID-19 web page
-
NHS fundraising initiatives such as Captain Tom Moore’s fundraising appeal
for ‘NHS Charities Together’
- HMRC
-
Online investment scams promoting fake celebrity-endorsed investment
opportunities
-
Online investment scams imitating genuine investment firms
What to look out for
-
A website that automatically asks you to run software or download a file
when you’re not expecting to do so.
-
A website tells you that your device is infected with malware or that your
browser extensions or software are out-of-date.
-
A website claims you have won a prize and requests your personal information
to claim it.
-
Suspicious emails (phishing emails) which include links to malicious websites.
A phishing email can appear to come from a trusted person and might look like
the sort of correspondence you receive from that person, however it contains
a link to a malicious or phishing website.
-
Be vigilant and always check for official website addresses and verify
social media accounts.
-
Check the Uniform Resource Locator (URL), web address of the web page to
ensure it is a real site and there are no spelling mistakes.
-
Ensure that the website address starts with HTTP and has a lock icon.
Websites without a padlock icon are not secure. If the padlock icon is not
there, or the browser says not secure, then don’t use the site.
-
Browse the website – ensure you double-check the website and the contents
on it. Watch out for poor English, such as spelling and grammar mistakes,
or phrases that don’t sound quite right.
-
Do not click on any links or downloads, enter personal or payment details
or create an account on suspicious websites.