Lead Image © tobkatrina, 123RF.com

Detecting phishing domains with dnstwist

Trappers

Article from ADMIN 47/2018

By Thomas Bär , By Frank-Michael Schlede

With a small script, you can locate phishing domains and determine whether they imitate your websites.

A User's browser can be redirected to a domain name other than the one they intended in many ways. For example, URLs with mixed up letters or with similar names have proven to be an effective means of detouring a request.

Anyone responsible for the operation and maintenance of a company website is probably familiar with complaints and emergency calls from users saying that a website cannot be reached. Often users have simply made a typing error, which only becomes a problem if the incorrect address takes them to a page that actually harms the user's computer (e.g., by installing malware).

Things get even worse if, for example, customers arrive at what they think is the company's website, when it is in fact a malicious copy that, at best, only confuses the user or, in the worst case, installs malware or causes financial damage. Therefore, it makes sense for IT staff responsible for the company website to search for domains with similar names, check to see whether those domains distribute dangerous content, and warn users about them.

Automatic Name Finding

Although you could try out different domain name combinations by hand, this method is not only inconvenient, but also time-consuming and error-prone. Such a task can and should be automated. Marcin Ulikowski, who works as a security consultant at Sony, developed a Python script more than two years ago that handles this work very quickly and reliably. He explains on his website that a user who wants to check all variants of "google.com" manually would need more than 300,000 queries and that this number would then increase to more than 5 million queries for "facebook.com" – which is one good reason for assigning this task to Ulikowski's Python script dnstwist [1].

This script works quite simply: You pass in a domain name. The script then uses

...

Use Express-Checkout link below to read the full article (PDF).