# Is my browser being hijacked? (web address) **URL:** \ **Category:** Factual Questions\ **Created:** [February 10, 2012, 1:59am UTC](https://boards.straightdope.com/t/is-my-browser-being-hijacked-web-address/612363 "2012-02-10T01:59:04Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Lumpy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lumpy/32/446_2.png) [@Lumpy](https://boards.straightdope.com/u/Lumpy)\ **Post date:** [February 10, 2012, 1:59am UTC](https://boards.straightdope.com/t/is-my-browser-being-hijacked-web-address/612363/1 "2012-02-10T01:59:04Z")
I keep trying to go to [noparse][http://www.google.com](http://www.google.com), and it keeps getting redirected to [https://www.google.com](https://www.google.com)[/noparse] Is this just an alternate format or is a virus sending my browser to a clone site? ---
**Author:** ![jz78817](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jz78817/32/1028_2.png) [@jz78817](https://boards.straightdope.com/u/jz78817)\ **Post date:** [February 10, 2012, 2:09am UTC](https://boards.straightdope.com/t/is-my-browser-being-hijacked-web-address/612363/2 "2012-02-10T02:09:41Z")
it’s intentional: > **[Making search more secure](https://googleblog.blogspot.com/2011/10/making-search-more-secure.html)** > > Insights from Googlers into our products, technology, and the Google culture https means it’s a secure (encrypted) connection. ---
**Author:** ![tellyworth](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tellyworth](https://boards.straightdope.com/u/tellyworth)\ **Post date:** [February 10, 2012, 2:11am UTC](https://boards.straightdope.com/t/is-my-browser-being-hijacked-web-address/612363/3 "2012-02-10T02:11:11Z")
[https://www.google.com/](https://www.google.com/) is legit, the encrypted version of [http://www.google.com/](http://www.google.com/). Your browser should give you an indication of whether or not it trusts that the site is the real one - a padlock icon or a company name near the address bar. Click on it. ---
**Author:** ![Lumpy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lumpy/32/446_2.png) [@Lumpy](https://boards.straightdope.com/u/Lumpy)\ **Post date:** [February 10, 2012, 2:26am UTC](https://boards.straightdope.com/t/is-my-browser-being-hijacked-web-address/612363/4 "2012-02-10T02:26:44Z")
Big relief! Thanks all. ---
**Author:** ![Askance](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/askance/32/8281_2.png) [@Askance](https://boards.straightdope.com/u/Askance)\ **Post date:** [February 10, 2012, 4:00am UTC](https://boards.straightdope.com/t/is-my-browser-being-hijacked-web-address/612363/5 "2012-02-10T04:00:27Z")
FYI, given that the URL itself is the same, the preceding protocol signifier (http vs https) cannot mean you’ve been sent to another site. It just means you are attempting to use a different protocol to the same site. ---
**Author:** ![Chimera](https://avatars.discourse-cdn.com/v4/letter/c/8e8cbc/32.png) [@Chimera](https://boards.straightdope.com/u/Chimera)\ **Post date:** [February 10, 2012, 4:05am UTC](https://boards.straightdope.com/t/is-my-browser-being-hijacked-web-address/612363/6 "2012-02-10T04:05:40Z")
I only get the https when I’m signed in with my gmail account. Look in the upper right. Is your computer signed in? ---
**Author:** ![Lumpy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lumpy/32/446_2.png) [@Lumpy](https://boards.straightdope.com/u/Lumpy)\ **Post date:** [February 10, 2012, 2:26pm UTC](https://boards.straightdope.com/t/is-my-browser-being-hijacked-web-address/612363/7 "2012-02-10T14:26:52Z")
> [@Askance](#): > > FYI, given that the URL itself is the same, the preceding protocol signifier (http vs https) cannot mean you’ve been sent to another site. It just means you are attempting to use a different protocol to the same site. Good to know; although a really sneaky virus could fake the displayed address altogether and let a third-party site pass through one’s searches to and from Google. Has this in fact been done? ---
**Author:** ![engineer\_comp\_geek](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/engineer_comp_geek/32/504_2.png) [@engineer\_comp\_geek](https://boards.straightdope.com/u/engineer_comp_geek)\ **Post date:** [February 10, 2012, 2:52pm UTC](https://boards.straightdope.com/t/is-my-browser-being-hijacked-web-address/612363/8 "2012-02-10T14:52:32Z")
> [@Lumpy](#): > > Good to know; although a really sneaky virus could fake the displayed address altogether and let a third-party site pass through one’s searches to and from Google. Has this in fact been done? There’s a thing called DNS cache poisoning. Basically, [www.google.com](http://www.google.com) is meaningless to a computer. The computer needs to convert that into numbers. It does that through the Domain Name System (DNS). The computer sends [www.google.com](http://www.google.com) to the DNS server, and the server sends back the numbers to your computer. There are a small number of root DNS servers that contain the “master list” for the entire internet. This list gets distributed out to the DNS servers that your internet provider uses. If someone can hack into your internet provider’s system and change the numbers in that list, they can redirect all of your google searches through their own system and do whatever they want with the data going back and forth. Since your ISP’s list is referred to as a “cached” list (it’s just a copy of the original from the root DNS servers) this is called DNS cache poisoning. The bad part about it is that it can affect you even though your own system doesn’t have a virus. DNS lookup starts with your computer, and goes up through the chain of DNS servers until it reaches the root DNS servers if necessary. Another type of malware can intercept the DNS search on your own computer and give it a false number. Both of these types of redirects to malicious sites are common. ---
**Author:** ![Gagundathar](https://avatars.discourse-cdn.com/v4/letter/g/a183cd/32.png) [@Gagundathar](https://boards.straightdope.com/u/Gagundathar)\ **Post date:** [February 10, 2012, 2:56pm UTC](https://boards.straightdope.com/t/is-my-browser-being-hijacked-web-address/612363/9 "2012-02-10T14:56:27Z")
Yeah, and server side processing is supposed to more secure. You can’t protect against somebody who has successful root to a server that you count on to be OK. You count on them because security is what you are paying for along with bandwidth and storage. How common is this? ---
**Author:** ![Askance](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/askance/32/8281_2.png) [@Askance](https://boards.straightdope.com/u/Askance)\ **Post date:** [February 13, 2012, 4:34am UTC](https://boards.straightdope.com/t/is-my-browser-being-hijacked-web-address/612363/10 "2012-02-13T04:34:24Z")
> [@Lumpy](#): > > Good to know; although a really sneaky virus could fake the displayed address altogether and let a third-party site pass through one’s searches to and from Google. Has this in fact been done? The distinction between http:///sitename and [https://sitename](https://sitename) is not affected by that consideration. If the latter was hijacked elsewhere then so would the former be.