The anatomy of a maker’s address
A web address has four parts, and only one of them identifies who is answering. Read from the right: the registrable domain is the last two labels before the first single slash (for most makers, a brand word and a top-level domain such as .com). Any labels to the left of it are subdomains, which the owner may name however it likes; whatever follows that first single slash forms the path, chosen just as freely.
https://central.bitdefender.com/activate
- Scheme — the padlock only says the connection is encrypted, not who owns the site
- Subdomain — chosen freely by whoever owns the part to its right
- Registrable domain — the only part that identifies the owner
- Path — also chosen freely by the owner
The consequence is simple to state. central.bitdefender.com belongs to Bitdefender because the registrable domain is bitdefender.com. An address in which the brand word appears to the left of an unrelated domain, or after the slash, belongs to whoever owns that unrelated domain.
Where the makers actually keep their pages
The addresses below are taken from the makers’ own documentation on the date this page was checked. They are given so that the pattern is recognizable, not as a list to be typed from memory; the makers move pages from time to time, and the registrable domain is the part that stays constant.
| Maker | Registrable domain | Documented pages |
|---|---|---|
| McAfee | mcafee.com | Key redemption at mcafee.com/activate; account at home.mcafee.com and protection.mcafee.com |
| Norton | norton.com | Retail key entry at norton.com/setup; documentation and blog pages on subdomains of norton.com |
| Bitdefender | bitdefender.com | Account at central.bitdefender.com; documentation on further paths of bitdefender.com |
| ESET | eset.com | Account at home.eset.com; documentation on a further subdomain of eset.com |
| TrendLife (Trend Micro) | trendlife.com and trendmicro.com | Activation at account.trendlife.com/setup/landing since April 2026 (previously account.trendmicro.com); documentation on a further subdomain of trendlife.com |
| Webroot | webroot.com | Installer page at webroot.com/safe; account at account.webroot.com |
| Avast | avast.com | Account at id.avast.com; reseller-code exchange at myaccount.avast.com |
| AVG | avg.com | Account at id.avg.com |
| Avira | avira.com | Account at my.avira.com; code page at avira.com/en/activation |
| F-Secure | f-secure.com | Account and code entry at my.f-secure.com |
| Kaspersky | kaspersky.com | Account and code entry at my.kaspersky.com; no sales in the United States since July 2024 |
| Malwarebytes | malwarebytes.com | Account at my.malwarebytes.com |
| Sophos Home | sophos.com | Dashboard at my.sophos.com; purchases through the reseller Cleverbridge, on cleverbridge.com |
Two of these entries show the pattern in action. home.mcafee.com, home.eset.com and central.bitdefender.com are all subdomains of the maker’s own registrable domain. TrendLife’s move from trendmicro.com to trendlife.com was announced on the maker’s own documentation site, and the maker states that the old address continues to work while the name changes over.
What a genuine activation page asks for
The genuine pages ask for a small and predictable set of things, and every item is entered by the purchaser into a field on the page.
- The key or code, in the shape described on the activation page.
- An email address, and either an account password or a one-time code sent to that address, to create or sign in to the maker’s account.
- Sometimes, payment card details, when the activation screen doubles as enrollment in automatic renewal. Norton, McAfee and TrendLife each document this.
- Agreement to the maker’s license terms.
The makers also publish what they do not do. McAfee states that it will never ask a customer to confirm personal details by email, will never require a call to a phone number given in an email or text, and will never call to ask for payment for customer service. Norton states that legitimate Norton emails never request passwords, Social Security numbers or card details, never come from a free email provider such as gmail.com, and never try to initiate a remote-access session unprompted.
Patterns that identify a look-alike
Pages built to resemble activation pages follow a small number of structural patterns. None of the examples below is a real address; each uses the reserved example domains so that the shape, rather than any particular site, is what is shown.
| Pattern | Shape | Why it is not the maker’s page |
|---|---|---|
| Brand as subdomain | brandname.example.net | The registrable domain is example.net; the brand word was added by its owner |
| Brand in the path | example.org/brandname-activate | Paths are free text; the site belongs to example.org |
| Hyphenated or extended brand | brandname-activation.example | Registering a domain containing a brand word does not make its owner the maker |
| Free hosting platform | A page on a site-builder or document-sharing service carrying the brand’s name in its title | The registrable domain is the platform’s; anyone can publish there |
| Address in the text, not the bar | A page that prints brandname.com/activate in large type while the address bar shows something else | Printed text is content; only the address bar identifies the site |
Content gives the second set of signals. A telephone number presented as the way to activate; a countdown or a claim that a license will be lost in minutes; an offer of an “activation service” for a fee; a request to install a program that lets someone else operate the computer; and payment routes such as gift cards or bank transfer. None of these appears on the makers’ pages, because none is part of the mechanism described on this site.
Renewal notices and invoices that arrive uninvited
The most common impersonation does not involve an activation page at all. It is an email, text message or calendar invitation stating that a subscription has renewed or is about to renew for a large sum, with a telephone number to call in order to cancel. Norton documents the auto-renewal version, the fake order-confirmation version and, more recently, calendar invitations, stating that it never sends calendar invites related to billing or payment. The follow-on, once the number is called, is a request for remote access to the computer or a bank login so that a “refund” can be processed.
The Federal Trade Commission’s guidance describes the same sequence and offers the check that resolves it: a person who believes a renewal message might be genuine contacts the company through a route they already know to be real, or looks at their own card statement; if no transaction for the subscription exists, the message was not from the company. In the model described on this site, the equivalent check is the account on the maker’s domain, which shows the true renewal date and the true amount.
The makers accept reports of messages that misuse their names: McAfee publishes an address for forwarding fraudulent emails on its scam-awareness page, Norton on its page about recognizing scam emails, and the Federal Trade Commission accepts reports at reportfraud.ftc.gov. Those pages are linked below.
Search results and advertisements
The Federal Trade Commission also notes that impersonators try to have their pages appear in search results and place their own advertisements. A listing’s position on a results page, whether paid or not, is therefore not a form of verification, and neither is a large logo. The address bar after the page has loaded is the only thing on the screen that the page’s author does not control.