Url

Definition

A URL (**Uniform Resource Locator**) is the address you type into a browser to access something on the web — like a webpage, image, video, or file. It tells your browser **where** to go and **how** to get there.

Example:

```
https://login.example.com:8080/account/reset?user=tom#section2
```

Breaking down the parts:

**1. Scheme (Protocol)** – `https://`
Tells the browser how to communicate with the server. Common ones: `http`, `https`, `ftp`, `mailto`.

**2. Host (Domain or IP)** – `login.example.com`
The server’s address. Can be a domain name (`example.com`) or an IP address (`203.0.113.50`).

**3. Port (Optional)** – `:8080`
Specifies the network port to connect to. Default ports (80 for HTTP, 443 for HTTPS) are usually omitted.

**4. Path** – `/account/reset`
The location of the resource on the server, often mapping to a file or route.

**5. Query String (Optional)** – `?user=tom`
Key-value pairs sent to the server. Multiple parameters are separated by `&`. Example: `?user=tom&reset=true`.

**6. Fragment (Optional)** – `#section2`
Points to a specific part of the page. The fragment is handled by the browser and isn’t sent to the server.

In investigations, URLs are critical because they can reveal:

* Malicious domains or IP addresses used in phishing or malware delivery
* Suspicious parameters (e.g., `?file=../../etc/passwd` for directory traversal)
* Infrastructure reuse between different attacks
* Whether a link uses HTTP vs. HTTPS (which can affect security)

Real-world examples:

* Many phishing kits hide malicious payloads in long, obfuscated query strings.
* Malware download URLs often use unusual ports (`:8080`, `:4444`) to evade detection.
* Ransomware leak sites are often accessed via `.onion` URLs on the Tor network.

Url

Definition

Explore More Terms