Deceptive Link Destination
A link in the message is presented so it seems to lead to one place while it actually leads to another. Disguising the destination makes the link look familiar or trusted.
Also known as
- Aliases
-
- URL spoofing
- disguised link
Sub-techniques
TE0039.1
Spoofed Hyperlink Label
The link's visible text shows a trusted web address or site name, while the link itself points to a different address. The text you see and where the link goes are set separately.
TE0039.2
URL Character Obfuscation
Characters in the link's web address are swapped for look-alikes, hidden, or encoded, such as a Cyrillic "а" for a Latin "a", so it reads as a different site. The difference can be invisible.
TE0039.3
Trusted Name in Subdomain or Path
A trusted name sits in the extra parts of a web address, as in "microsoft.com.login.example.net", while the site that actually opens is example.net. Long addresses can push that part out of view.
TE0039.4
URL Userinfo Obfuscation
The web address starts with a trusted name followed by an @, as in "https://[email protected]". Browsers treat the part before the @ as a username and open the site after it.