• Skip to primary navigation
  • Skip to main content
  • Skip to footer

Cisco Umbrella

Enterprise network security

  • Contact Sales
  • Login
    • Umbrella Login
    • Cloudlock Login
  • Why Us
    • Why Cisco Umbrella
      • Why Try Umbrella
      • Why DNS Security
      • Why Umbrella SASE
      • Our Customers
      • Customer Stories
      • Why Cisco Secure
    • Fast Reliable Cloud
      • Global Cloud Architecture
      • Cloud Network Status
      • Global Cloud Network Activity
    • Unmatched Intelligence
      • A New Approach to Cybersecurity
      • Interactive Intelligence
      • Cyber Attack Prevention
      • Umbrella and Cisco Talos Threat Intelligence
    • Extensive Integrations
      • IT Security Integrations
      • Hardware Integrations
      • Meraki Integration
      • Cisco Umbrella and SecureX
  • Products
    • Cisco Umbrella Products
      • Cisco Umbrella Cloud Security Service
      • Recursive DNS Services
      • Cisco Umbrella SIG
      • Umbrella Investigate
      • What’s New
    • Product Packages
      • Cisco Umbrella Package Comparison
      • – DNS Security Essentials Package
      • – DNS Security Advantage Package
      • – SIG Essentials Package
      • – SIG Advantage Package
      • Umbrella Support Packages
    • Functionality
      • DNS-Layer Security
      • Secure Web Gateway
      • Cloud Access Security Broker (CASB)
      • Cloud Data Loss Prevention (DLP)
      • Cloud-Delivered Firewall
      • Cloud Malware Protection
      • Remote Browser Isolation (RBI)
    • Man on a laptop with headphones on. He is attending a Cisco Umbrella Live Demo
  • Solutions
    • SASE & SSE Solutions
      • Cisco Umbrella SASE
      • Secure Access Service Edge (SASE)
      • What is SASE
      • What is Security Service Edge (SSE)
    • Functionality Solutions
      • Web Content Filtering
      • Secure Direct Internet Access
      • Shadow IT Discovery & App Blocking
      • Fast Incident Response
      • Unified Threat Management
      • Protect Mobile Users
      • Securing Remote and Roaming Users
    • Network Solutions
      • Guest Wi-Fi Security
      • SD-WAN Security
      • Off-Network Endpoint Security
    • Industry Solutions
      • Government and Public Sector Cybersecurity
      • Financial Services Security
      • Cybersecurity for Manufacturing
      • Higher Education Security
      • K-12 Schools Security
      • Healthcare, Retail and Hospitality Security
      • Enterprise Cloud Security
      • Small Business Cybersecurity
  • Resources
    • Content Library
      • Top Resources
      • Cybersecurity Webinars
      • Events
      • Research Reports
      • Case Studies
      • Videos
      • Datasheets
      • eBooks
      • Solution Briefs
    • International Documents
      • Deutsch/German
      • Español/Spanish
      • Français/French
      • Italiano/Italian
      • 日本語/Japanese
    • For Customers
      • Support
      • Customer Success Webinars
      • Cisco Umbrella Studio
    • Get the 2022 Cloud Scurity Comparison Guide
  • Trends & Threats
    • Market Trends
      • Hybrid Workforce
      • Rise of Remote Workers
      • Secure Internet Gateway (SIG)
    • Security Threats
      • How to Stop Phishing Attacks
      • Malware Detection and Protection
      • Ransomware is on the Rise
      • Cryptomining Malware Protection
      • Cybersecurity Threat Landscape
      • Global Cyber Threat Intelligence
      • Cyber Threat Categories and Definitions
    •  
    • Woman connecting confidently to any device anywhere
  • Partners
    • Channel Partners
      • Partner Program
      • Become a Partner
    • Service Providers
      • Secure Connectivity
      • Managed Security for MSSPs
      • Managed IT for MSPs
    •  
    • Person looking down at laptop. They are connecting and working securely
  • Blog
    • News & Product Posts
      • Latest Posts
      • Products & Services
      • Customer Focus
      • Feature Spotlight
    • Cybersecurity Posts
      • Security
      • Threats
      • Cybersecurity Threat Spotlight
      • Research
    •  
    • Register for a webinar - with illustration of connecting securely to the cloud
  • Contact Us
  • Umbrella Login
  • Cloudlock Login
  • Free Trial
Security

Avoid Scams While Shopping Online This Holiday Season

By Kristyanne Patullo
Posted on November 21, 2014
Updated on October 15, 2020

Share

FacebookTweetLinkedIn

It’s almost the most wonderful time of the year! Most people might consider that the December holiday season but for me it’s definitely Black Friday and Cyber Monday. Gone are the days of pitching a tent outside of Best Buy at 3am—you can now get all the awesome deals from the convenience of your couch!
The problem is, as with most large events on the Internet, there will be more people than usual looking for ways to cash in on unsuspecting shoppers. Using OpenDNS can help prevent you from falling victim to these attacks, but here are a few other tips on how to increase your safety and security while scoring some deals:
Check Where Your Emails are Coming From
As a savvy shopper I definitely love coupons. In my opinion, one of the best places to get coupons is via email. You have to be careful though–some of the deals really are too good to be true. Phishers are getting more advanced, and are always looking for better ways to trick people into clicking on their links. Sometimes determining whether an email is legitimate or a phish can be like deciphering the microscopic fine print that lists the exclusions on coupons.
One of the biggest indicators of a phishing email is where it’s coming from. Remember, these people make money off of tricking you. Many phishing emails look very legitimate and it often takes a diligent eye to spot a phish.
One of the first things that I do if I receive a suspicious-looking email is check the domain that the email came from. Most legitimate companies have their own domain from which all emails will be sent. In an email address, the part after the @ is the domain. The part before the domain is the local part, which is chosen, so it can say just about anything. Take a look at the below example:
Screen Shot 2014-11-21 at 11.52.44 AMThe local part of the email address says macysshopping4, but remember that part can be chosen. Why would an email from Macy’s be sent from a Gmail account? A common phishing technique is to make the local part of an email address look legitimate to trick end users. The domain Macy’s coupons actually come from is @email.macys.com.
Email addresses can also be spoofed; a correct sending address does not necessarily mean the email is legitimate. Spoofing is when the sender email address is forged. Someone can forge sending you an email from shop@email.macys.com but it wasn’t actually sent by Macy’s. That is why you should also check the content of the email.
Check Before You Click
Did you know that before you click, most browsers will show where the link you are hovering over goes?
Screen Shot 2014-11-21 at 11.54.50 AM
Similar to emails, webpages also have domains. When I hover over a link in this email the browser shows me the location the link will take me to before I click on it. If I know this email is from Macy’s, it makes sense that links within this email should take me to macys.com.
The domain for a webpage is different than an email domain. The subdomain, domain, and top level domain are between the protocol and path of a URL:
Screen Shot 2014-11-21 at 11.56.38 AMThe protocol declares how your browser should communicate with the web server you are browsing, but we’ll talk about this later.
The subdomain is a subdivision of the main domain. In the above example, community is a section of the domain opendns. Every domain ends in a top level domain (TLD), TLDs form the root zone of the DNS system. It’s important to check that the domain of a web page correlates with the web page you are intending to visit.
The path refers to the file or directory on the webserver where a particular URL lives. Like with the local part of an email address, the path can be edited to say anything.
If you are in an email you believe is from Macy’s, which URL is most likely not a phish?
hxxp://www.macys.com/shop/womens-clothing
or
hxxp://www.xqnrr.com/macys/shop/womens-clothing?
If you chose the first URL you are correct. The domain of this URL is macys.com, which shows that this URL is hosted on the Macy’s domain and the path goes to the women’s clothing section. The second URL is hosted on the domain xqnrr.com but the path of the URL was made to look like it is a Macy’s website.
Confirm You are Using a Secure Connection
Before you enter any payment or personal information into a website, make sure your browser is using an SSL (Secure Socket Layer) connection. SSL provides a secure connection between a web server and your browser. This helps ensure that a third party cannot easily view your payment/personal information.
How can you tell if your browser has a secure connection? The URL will start with https:// and you will see a lock in the address bar:
Screen Shot 2014-11-21 at 12.00.55 PM
An https:// at the beginning of a URL indicates that the data you are transmitting will be encrypted between the client (your browser) and the end server (the server the website you are accessing is hosted on) to better protect your information.
Paypal phishes are quite frequent; one way to spot a Paypal phish is that it will lack an SSL connection:
Screen Shot 2014-11-21 at 12.14.23 PM
This specific phish also has the bonus of a spelling error which is also indicative of phishing pages and emails.
Also, be wary of pages that are asking you for unnecessary information. You shouldn’t need to enter your social security number to purchase a new iPad. Be cautious of the data you are providing/putting out on the World Wide Web.
Make Sure Your Computer/Device is Virus Free and Up to Date
Before the big shopping day you should confirm that the computer or device you will be using for shopping is not infected with malware or adware and that all updates have been completed.
If your computer has malware on it your information becomes very easy to steal. Certain types of malware install keyloggers on your machine that can record every keystroke and provide malicious parties with usernames, passwords, credit card numbers, and any other personal information that you type. Any type of malware or adware on your machine makes it less secure, so be sure to use up-to-date AntiVirus that scans your machine regularly for these types of infections.
Also make sure that all updates have been completed on your machine. Many updates, particularly for your operating system and browser, contain security patches that protect you from known vulnerabilities.
Use OpenDNS!
Our DNS service offers an added layer of security that will protect you from known phishing sites. If you do happen to come across a shady site while shopping you’ll see the OpenDNS block page rather than a page that can potentially steal your data or infect your machine.
Be Smart
The best way to be safe while shopping on the Internet is to be smart about what you are doing. Take the necessary precautions to make sure your computer or device is clean and updated. Also take the extra minute to confirm that the email or website you are viewing is safe. Sometimes being safe can be time consuming, but it will take a lot less time than you’d have to spend reclaiming stolen information, fighting fraud charges, or in extreme cases, reclaiming your identity.

Previous Post:

Previous Article

Next Post:

Next Article

Follow Us

  • Twitter
  • Facebook
  • LinkedIn
  • YouTube

Footer Sections

What we make

  • Cloud Security Service
  • DNS-Layer Network Security
  • Secure Web Gateway
  • Security Packages

Who we are

  • Global Cloud Architecture
  • Cloud Network Status
  • Cloud Network Activity
  • OpenDNS is now Umbrella
  • Cisco Umbrella Blog

Learn more

  • Webinars
  • Careers
  • Support
  • Cisco Umbrella Live Demo
  • Contact Sales
Umbrella by Cisco
208.67.222.222+208.67.220.220
2620:119:35::35+2620:119:53::53
Sign up for a Free Trial
  • Cisco Online Privacy Statement
  • Terms of Service
  • Sitemap

© 2023 Cisco Umbrella