Mental Models of Domain Names and URLs

Many domain impersonation strategies have been observed in the wild. Phishers utilize typos, uncommon top-level domains, Unicode characters, subdomains, and extra tokens to make domains that are visually similar to high-value target domains like banks, email providers, or shopping websites. Quantitative research tells us that many users fall for these impersonation attempts, but it is not clear why users have a difficult time comprehending how domains and URLs are structured. Even engaged users are often unable to identify examples of domain impersonation when primed to look for them. In this poster and abstract, we describe the design of a semi-structured interview to obtain qualitative data on the mental models that users have of URL structure, domain name ownership, and web browsers. We describe the outcome of a pilot of our interview study on five subjects, and discuss our plans for running the study at full scale.