Skip to content

Conversation

@glaubermagal
Copy link

@glaubermagal glaubermagal commented Nov 5, 2024

You might be wondering why "ɡithub.com" is blocklisted. The answer is: it's not the real github.com, though they look similar. Still unsure? Try comparing "ɡithub.com" === "github.com" in your browser console—you'll see it returns false.

Using domains with mixed scripts for malicious purposes is called IDN Homograph Attack. It is a very advanced type of attack – and I plan keep adding relevant homograph domains here from now on, so we will help prevent people from being deceived by them.

I used a tool I created, EvilURL, to analyze the actual github.com domain. I discovered a concerning issue: some registrars allow domains with mixed character sets, enabling bad actors to create domains that look nearly identical to legitimate ones. And this malicious domain "ɡithub.com" is registered and leading to a malicious website.

image

Please follow me on github and give a start to my repo. This will help me keeping improving my Cybersecurity tool.

You may be asking, why is github.com is being blocklisted? Well, it is not actual github.com, although they are visually similar. Still in doubt? Compare "ɡithub.com" === "github.com" in your browser console, the result will be `false`
@glaubermagal glaubermagal changed the title Update blocklist.yaml Add IDN Homograph Domains to blocklist.yaml Nov 5, 2024
@glaubermagal glaubermagal changed the title Add IDN Homograph Domains to blocklist.yaml Add IDN Homograph Domain to blocklist.yaml Nov 9, 2024
@glaubermagal glaubermagal changed the title Add IDN Homograph Domain to blocklist.yaml Add IDN Homograph Domains to blocklist.yaml Nov 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant