Domains Use Homographic Characters to Create Hard to Spot Phishing URL's

HTTP Blue Button. More Buttons Like that is in My Folio.Website domains can use homographic characters to create very hard-to-spot phishing URLs, Threatpost reports. Cybersecurity researcher Avi Lumelsky demonstrated how easy it is to create one of these domains using the symbol “ɢ” instead of the ASCII character “G” to set up fake Google domains. Lumelsky was able to register ɢ, ɢ, ɢ, ɢ, ɢ, ɢ, and ɢ

Lumelsky then obtained LetsEncrypt certificates for his domains so the browser would mark them as secure, and he copied and pasted the JavaScript code from Google’s real sites onto his own matching domains. This made his sites look and act just like Google’s services. For example, “ɢ” works 

He posted links to his sites on security-focused subreddits and showed that these domains were able to fool even some technically-minded people. While some platforms display the “ɢ” as “xn--,” Lumelsky noted that on mobile devices, the “ɢ” looks much the same as a regular “G.” Additionally, on every platform, the link preview is identical to the real Google site’s preview.

“Eventually, without much work, I ended up with hundreds of unique visitors (excluding the bots and security scanners or the platforms in which I posted),” Lumelsky said. “It looks and acts just like any google single-page application.”

Lumelsky explained that this technique could be used in phishing campaigns as well as for man-in-the-middle attacks.

“I am making the SSL handshake with the user,” he said. “The original Google application is served, it functions as expected, but I am exposed to the user’s traffic with the domain. Therefore, I can change the body of Google’s response.”

Fortunately, since Lumelsky is a white-hat researcher, he didn’t use these sites for anything malicious. However, criminals can use the same techniques to trick people into handing over their credentials and other sensitive information.

New-school security awareness training can teach your employees to be wary when they follow a link to a website, even if they don’t spot any easily visible warning signs.

Threatpost has the story:

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Anti-Phishing Guide ebook

Get the latest about social engineering

Subscribe to CyberheistNews