However, in the string , there is no colon or double slash ( :// ). This is critical. It reads as httpshdking — a single, continuous word. Therefore, this is NOT a valid web protocol . Legitimate browsers will not recognize httpshdking as a secure connection. Instead, it is likely a brandable string or a username that mimics the look of a secure URL to inspire false trust.