1

I'm writing a blog post analyzing a list of phishing domains and I'm coming across a lot of IDN homograph attack domains and these "subdomain attack domains" but I cannot find the technical/good way to describe it.

For example, this type of domain is used to phish microsoft login details

login.microsoft.com.account.auth.redacted.com

How would you describe/categorize that style of attack with the same calibre of IDN homograph attack? The best I've come up with is "subdomain attack" but I don't think it makes sense in this context.

Improve this question

1 Answer 1

Reset to default
1

IDN homograph attack is not correct. Although the idea of this type of attack is exploiting the fact that many different characters look alike, it still allows for subdomains.

In the Domain Name System (DNS) hierarchy, a subdomain is a domain that is a part of a main domain. Subdomain.

Despite this, do not be confused. We are treating the whole address as resolving to an IP address in this scenario. E.g. localhost -> 127.0.0.1, equally login.microsoft.com.example.com -> 127.0.0.1.

What you are describing login.microsoft.com.example.com is deceptive phishing. Some web browsers will highlight the subdomain leaving the domain grey. E.g. login.microsoft.com.example.com

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .