Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add IDN Homograph Domains to blocklist.yaml #1426

Open
wants to merge 4 commits into
base: master
Choose a base branch
from

Conversation

glaubermagal
Copy link

@glaubermagal glaubermagal commented Nov 5, 2024

You might be wondering why "ɡithub.com" is blocklisted. The answer is: it's not the real github.com, though they look similar. Still unsure? Try comparing "ɡithub.com" === "github.com" in your browser console—you'll see it returns false.

Using domains with mixed scripts for malicious purposes is called IDN Homograph Attack. It is a very advanced type of attack – and I plan keep adding relevant homograph domains here from now on, so we will help prevent people from being deceived by them.

I used a tool I created, EvilURL, to analyze the actual github.com domain. I discovered a concerning issue: some registrars allow domains with mixed character sets, enabling bad actors to create domains that look nearly identical to legitimate ones. And this malicious domain "ɡithub.com" is registered and leading to a malicious website.

image

Please follow me on github and give a start to my repo. This will help me keeping improving my Cybersecurity tool.

You may be asking, why is github.com is being blocklisted? Well, it is not actual github.com, although they are visually similar. Still in doubt? Compare "ɡithub.com" === "github.com" in your browser console, the result will be `false`
@glaubermagal glaubermagal changed the title Update blocklist.yaml Add IDN Homograph Domains to blocklist.yaml Nov 5, 2024
@glaubermagal glaubermagal changed the title Add IDN Homograph Domains to blocklist.yaml Add IDN Homograph Domain to blocklist.yaml Nov 9, 2024
@glaubermagal glaubermagal changed the title Add IDN Homograph Domain to blocklist.yaml Add IDN Homograph Domains to blocklist.yaml Nov 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant