Re:Attackers Used Look-Alike Domains to Steal $1M from a Chi...
by stef25 on Saturday December 07, 2019 @03:04PM
(#21732262)
The other day I was browsing a list of all my country's domains and noticed a bunch starting with xn-- and you just made me understand what these are.
None of them seem worth phishing for. In some cases when you google the site name, google will show results from sitename.tld and when you visit the site with the show_punycode true, it will actually load pages from the xn-- equivalent. So it looks like the "original" domain isn't even indexed or online at all.
In another case both the xn-- and "normal" domain sit side by side on the same server. I guess there's no harm in posting these:
cadzandie.be and xn--cadzandi-01a.be. Note there's no ë in the first domain
Another strange one is
xn--rembours-i1a.be
When you type in remboursé.be it actually redirects (?) to the xn-- equivalent.
I'm fascinated but having a hard time seeing sense in this.
None of them seem worth phishing for. In some cases when you google the site name, google will show results from sitename.tld and when you visit the site with the show_punycode true, it will actually load pages from the xn-- equivalent. So it looks like the "original" domain isn't even indexed or online at all.
In another case both the xn-- and "normal" domain sit side by side on the same server. I guess there's no harm in posting these:
cadzandie.be and xn--cadzandi-01a.be. Note there's no ë in the first domain
Another strange one is
xn--rembours-i1a.be
When you type in remboursé.be it actually redirects (?) to the xn-- equivalent.
I'm fascinated but having a hard time seeing sense in this.