How the Web Works — and Why Looks Can Deceive

A fake website can look exactly like the real one. In this lesson you learn what your browser actually does when it loads a page, why appearance proves nothing, and the one skill that cuts through every disguise: reading a web address to find the real domain. Later lessons on phishing and HTTPS build on this skill, so take your time with it.

What you'll be able to do

Explain what a browser does when it loads a page and read a web address to tell the real domain from a look-alike.

• Describe in plain words how a browser requests and builds a web page.
• Explain why a page's look, logos and even its code are not proof of who runs it.
• Find the real domain in a web address and spot common look-alike tricks.

What your browser does

A web browser (Chrome, Safari, Edge, Firefox and others) is the app you use to visit websites. Its main job is to ask a web server for a page and then display it. Pages are written in HTML (Hypertext Markup Language), a code made of tags that describe headings, paragraphs, links and images. Your browser reads that code and turns it into the page you see. Modern browsers also have built-in viewers for other formats, such as PDF documents.

A page is rarely one file. The HTML tells the browser to fetch other pieces too: images, styles, fonts and scripts. Dr. Al-Doori points out an important detail here. Some images are local, stored on the same server as the page. Others are borrowed: the page simply points to an image hosted on a different website. On screen, you can't tell the difference.

Why looks can deceive

The book explains why that detail matters. Criminals building a fake bank page can borrow the real bank's logos and graphics, so the counterfeit looks pixel-perfect. Back then, viewing the page's source code could reveal that the images were coming from somewhere unexpected.

Today's fakes go further. Criminals use ready-made phishing kits, and even rent phishing as a service, that copy a real site completely and host every image, font and button themselves (ENISA Threat Landscape 2025). The copy can be flawless. Most people also browse on phones, where viewing a page's source isn't practical.

So the modern rule is simple: how a page looks tells you nothing about who runs it. Not the logo, not the colours, not the friendly chat window, and not the padlock or connection icon either (Lesson 5.7 explains why). The two things that do tell you something are:

1. How you got there. A bookmark you saved, an address you typed, or the organisation's official app is far more trustworthy than a link in an unexpected message. UK and US authorities (the NCSC and the FTC) both advise contacting an organisation through its official website or a number you already know, never through a link or number in a message you weren't expecting.
2. The domain in the address bar. That is the next skill.

Reading a web address

A web address (URL) has a few parts. Take this invented example:

www.quillmontbank.test/accounts/login

All domains ending in .test or .example in this lesson are reserved for training and cannot be real public websites.

• The host name is everything before the first single slash: www.quillmontbank.test.
• The path is everything after it: /accounts/login. The owner can put anything here, including the word "secure" or another company's name. It proves nothing.
• Addresses usually begin with "https" followed by a colon and two slashes. That tells you the connection is encrypted, not who you are connected to.

Inside the host name, the part that matters is the registered domain: the name the owner registered, plus its ending. Here it is quillmontbank.test. Anything to the left of it (such as www. or login.) is a label the domain owner chose. Only the owner of quillmontbank.test can create login.quillmontbank.test.

The method: find the end of the host name (the first single slash), then read backwards from there. The ending (.test here; on real websites, an ending such as .com or .org) plus the word just before it (quillmontbank) is the registered domain. Some real country endings have two parts, such as .co.uk; for those you take three pieces from the end.

Now the tricks become easy to see:

• Real domain buried on the left: quillmontbank.test.account-check.test/login. Read backwards from the first slash: the registered domain is account-check.test. "quillmontbank.test" is just a label its owner added.
• Extra words: quillmontbank-secure.test. A hyphen makes a completely different domain. In a real public domain namespace, this would be a separately controlled domain, not the bank's.
• Swapped characters: quil1montbank.test (a number one for an L) or quillmontbnak.test (letters swapped). Easy to miss when you read quickly.
• A different ending: quillmontbank.example is not quillmontbank.test. On real websites the same trick swaps .com for an ending such as .co or .support.

On a phone, the address bar may show only part of the address. Tap it to see the whole thing before you trust it.

Domain-reading exercise

All names below are invented for practice. Don't type them into a browser. The real bank's domain is quillmontbank.test. For each address, write down its registered domain and decide: real or look-alike?

• 1. online.quillmontbank.test/login
• 2. quillmontbank.test-verify.example/secure
• 3. quillmont-bank.test/accounts
• 4. www.quillmontbank.test/help/quillmontbank-secure
• 5. quillmontbank.test.reset-access.test/
• 6. quiIlmontbank.test/login (look very closely)

Real-World Example

Imagine: Lina receives a text saying a parcel couldn't be delivered and she must pay a small redelivery fee. The link opens a page with the courier's exact logo, colours and tracking layout. Viewing the source wouldn't help: the kit hosts its own copy of every image. She taps the address bar and sees courier-redelivery-fee.test/track. The courier's name isn't even in the registered domain. She closes the page and checks her deliveries in the courier's official app instead. There is no parcel waiting. The look was perfect; the domain gave it away, and going to the source herself confirmed it.

From the Book to 2026

What the book teaches. A browser requests and renders HTML; fake bank pages often borrow the real bank's images; viewing a page's source can reveal those borrowed images; and you should trust the address bar, not the visuals.

Why it made sense. Many counterfeit pages of that era did load images straight from the real site, so the source code was a genuine clue. The core message, that looks prove nothing, is as true as ever.

What has changed. Modern platforms have changed this risk. Phishing kits now copy and host everything themselves, and most browsing happens on phones, so viewing the source is no longer a dependable check for ordinary users. Current guidance from the NCSC and the FTC is not to trust how a page looks and not to use links in unexpected messages.

What to do now. Reach important sites yourself, through a bookmark, a typed address or the official app. When you do need to judge a link, read the registered domain backwards from the first slash.

What Would You Do?

You search for your bank's name to log in. The first result, marked "Sponsored", shows the bank's name in its title, and the page it opens looks exactly like your bank's login page. The address bar reads quillmontbank-login.test/signin. What do you do?

Knowledge Check

Key Takeaways

• A browser fetches HTML and builds the page from many pieces, which may come from different places.
• Fake pages can copy everything, so a page's look (and even its source code) is not proof of who runs it.
• Find the registered domain by reading backwards from the first single slash. Everything to its left is a label the owner chose.
• The most reliable check is the route: reach important sites through a bookmark, a typed address or the official app.

Further Study

• LearnFree — Browser Basics (optional, external)

Sources

• UK NCSC — How to spot a scam
• US FTC — How To Recognize and Avoid Phishing Scams
• Chromium Blog (Google) — An Update on the Lock Icon
• ENISA — ENISA Threat Landscape 2025
• Dr. Tahseen Al-Doori — Cyber Security Essentials, Chapter 5: How Web Browsing Works