Most spoofed domain names are easy to detect. A cursory look at a domain name will tell you if you’re dealing with a duplicate domain: Amazon.net, for example, or g00gle.com. However, there is one type of spoofing that isn’t visible to the naked eye. Punycode can make domains look exactly like the real thing, which can be a big problem if your site is the one being spoofed. However, just because punycodes are convincing doesn’t mean they’re undetectable. Punycode attack detection is absolutely possible using automation and a little more investigation than usual.
Punycode Attack Detection: The Basics
What is punycode?
Punycode wasn’t created for attacks, but as a legitimate way to solve an internet problem; it’s a system for encoding Unicode characters that can’t be written in ASCII. Punycode was introduced in 2003 to internationalize the domain system, which is ASCII-only, meaning it doesn’t recognize non-Latin alphabets such as Arabic, Greek, or Cyrillic. Punycode converts these characters into an ASCII-compatible format that starts with xn–; when a browser or system sees xn--, it knows to decode the Punycode back into the intended Unicode characters.
Why is it called ‘punycode’?
Like the names of so many things in coding, the name ‘punycode’ is kind of playful. Punycode is a pun on Unicode, but also a commentary on the code itself: the small character set used in the encoded strings, and the encoded strings are short.
What’s a punycode attack?
Many non-Latin alphabets use characters that look identical to Latin letters. Cyrillic and Greek, for example, contain characters that are visually similar to letters in the Latin alphabet. In a punycode attack, cybercriminals take advantage of those similarities to create URLs that look identical to legitimate websites but actually lead to malicious sites.
Why is Punycode Attack Detection is an Important Tool for Security Teams
Why is it important to be aware of punycode scams?
There are many ways to spoof a domain; punycode is particularly insidious because without close inspection, the URL looks legitimate. If your users aren’t aware of punycode, they’re much more likely to fall for an attack — and there are many spoofing attacks. About 1 in 5 phishing attacks come from spoofed domains, because threat actors hope the lookalike domain will make their message seem legitimate.
How can you prevent punycode attacks?
You can’t stop a criminal who wants to spoof your domain, but you can make it more difficult for them to do so:
- Proactive domain registration: Register any similar domains, international domains and common misspellings of your brand.
- Domain monitoring: Use domain monitoring tools to detect newly registered lookalike domains.
- Use DMARC, SPF, and DKIM: DMARC, SPF, and DKIM are email authentication protocols that verify the domain or IP address the email was sent from.
- User education: Teach users to look for the xn- – before clicking.
- Threat intelligence: Use security platforms that scan for spoofed domains.
Integrate the world’s easiest to use and most comprehensive cybercrime database into your security program in 30 minutes.
How can you detect a punycode attack?
Early detection is key when it comes to mitigating risk from a punycode attack but manually scanning the internet for potential spoofed sites isn’t a practical solution for most teams. Using an automated solution to scan for malicious domains and lookalikes, however, will help your team find suspicious activity early and take down lookalike domains before they can cause damage to your brand, customers, or reputation. Automated platforms can also monitor forums and social media where bad actors congregate. Scanning for hacker chatter lets you know if your domain, digital assets, or brand has been compromised. This proactive approach to cybersecurity empowers you to take action before further harm can be done.
How Does Flare Help with Punycode Attack Detection
What can you do if your site has been spoofed?
Punycode attacks are a type of spoofing, and if your site is being spoofed, the most important thing to do is to get the lookalike domain taken down as quickly as possible. This means you need to find spoofed sites as soon as they’re put up — but manual scanning for spoofed domains is impractical at best and impossible at worst. This is where automation comes in. Flare’s Continuous Threat Exposure Management (CTEM) platform lets your team find and respond to lookalike domains by automatically scanning for malicious domains, notifying your team as soon as one is found, and initiating a domain takedown.
What are the benefits of Flare’s punycode attack detection service?
- Automated scanning and evaluation: Flare scans the web constantly, looking for information that’s been stolen, copied, or leaked. If any information from your actual site appears on a duplicate site, Flare will notify your team.
- Unlimited autonomous takedowns: Flare streamlines the process of requesting and monitoring takedowns of spoofed sites so that your team doesn’t have to keep track manually.
- Relevant notifications: Your team is likely suffering from alert fatigue. Flare only notifies you when a threat is relevant to your organization and your data.
How does a domain takedown work?
There’s only one way to get a malicious domain removed. Your team has to find it, verify it, report it, and request that the spoofed site is taken down. Depending on the domain and your location, you may have to report it to one of a few organizations:
- Law enforcement
- The relevant domain registrar
- The hosting provider
After you make your request, your team will need to monitor the site to make sure it’s actually removed, and follow up if it is not.
Punycode Attack Detection and Flare
The Flare Threat Exposure Management (TEM) solution empowers organizations to proactively detect, prioritize, and mitigate the types of exposures commonly exploited by threat actors. Our platform automatically scans the clear & dark web and prominent threat actor communities 24/7 to discover unknown events, prioritize risks, and deliver actionable intelligence you can use instantly to improve security. Protect your data and your users from punycode attacks with Flare.
Flare integrates into your security program in 30 minutes and often replaces several SaaS and open source tools. Learn more by signing up for our free trial.
