Erik van Straten<p>David, more and more I tend to think that a block list is mostly useless: scanmers continuously register new domain names (or buy cleansed old ones), and IPv4 addresses do regularly change as well (IPv6 may may make block lists even longer).</p><p>I guess we should consider to use allow lists. However, predicting which sites a person, such as your father, may want to visit in future, may be far from simple.</p><p>Unfortunately I'm not aware of a simple and (near-) perfect solution.</p><p>CYBERSECURITY AWARENESS<br>The best I can come up with is to teach people, when visiting a website:</p><p>1) Don't look at the page. It may be fake but identical to the one you expect. It is pointless and a waste of time to look for visual differences.</p><p>2) Make sure that you have a https connection. Chrome no longer shows a padlock, while most browsers hide "https://" or even "https://www.".</p><p>3) Inspect the address bar and locate the domain name of the website (Safari usually hides the rest, which sometimes is unfortunate if they click on a misleading link like:<br><a href="https://twitter.com/realDonaldTrump/status/890617797956456448" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">twitter.com/realDonaldTrump/st</span><span class="invisible">atus/890617797956456448</span></a> (this is NOT a tweet by Donald Trump).</p><p>4) The domainname is the part that follows after "https://" (often hidden) and usually ends right before the NEXT forward slash '/'<br>Note: there are some rare exceptions, such as<br> <a href="https://twitter.com:443/samykamkar" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">twitter.com:443/samykamkar</span><span class="invisible"></span></a><br>(more on Samy later), and/or:<br> https://user:password@x.com</p><p>If, after https://, no more forward slashes are shown in the address bar, then the domain name ends with the right-most character.</p><p>5) Its best to interpret domain names from right to left - if it were a "home" address written as follows:</p><p> 10.downingstreet.london.uk</p><p>6) IMPORTANT:</p><p>• The TLD (Top Level Domain name), at the full right, usually does not imply that the owner of a domain name - like samy.pl - is Polish or lives in Poland. Also, the server may be located anywhere on our globe, and may "move" without notice.</p><p>BTW, the owner of <a href="https://samy.pl/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">samy.pl/</span><span class="invisible"></span></a> , Samy Kamkar, is a well known LA-based hacker (and a terrific speaker!).</p><p>• The dot '.' is the (only) SEPARATOR that splits the domain name into multiple "segments" or subdomains;</p><p>• The minus sign "-" is the only permitted non-alphanumeric character in regular (ASCII) domain names (see also "IDNs" below). Officially underscores '_' are forbidden, but know and then they make it through the registration process.</p><p>*IMPORTANT*, the second of the following two domain names does NOT belong to Google (the first one does):<br> accounts.google.com<br> accounts-google.com<br>It is essential to be aware of this, as it is a typical trick used by scammers.</p><p>• Regular (ASCII) domain names are converted to lower case before being used. Note that, when I write:<br> security.nI<br>, that this is not the same as:<br> security.nl<br>(the latter ends with a lower case 'L', while the first domain name ends with an upper case 'i' - which would lead to a domain name registered in Nicaragua).</p><p>Therefore it's best to read the domain name from the browser's address bar AFTER opening the site (and hope that there's no malware that infects your browser, or a screaming pop up "your computer is infected with a virus"). If possible, use an ad-blocker or NoScript.<br>See also IDNs below.</p><p>7) Usually, if someone registers a domain name like google.com, they will automatically own ALL POSSIBLE SUBDOMAINS. This means that attackers CANNOT REGISTER A SUBDOMAIN of, for example, google.com (they'd have to hack the domain owner's DNS records, which may happen: <a href="https://www.bleepingcomputer.com/news/security/domain-shadowing-becoming-more-popular-among-cybercriminals/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/domain-shadowing-becoming-more-popular-among-cybercriminals/</span></a> ).</p><p>Note that, therefore, it would make EXTREME sense if you'd have to log in to:<br> login.microsoft.com<br>instead of to:<br> login.microsoftonline.com<br>(what are they smoking in Redmond?)</p><p>There are notable exceptions though, where domain owners SUBRENT subdomain names to (potentially malicious) third parties. This includes, but is not limited to *.workers.dev and *.pages.dev (see <a href="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/its-raining-phish-and-scams-how-cloudflare-pages-dev-and-workers-dev-domains-get-abused/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">trustwave.com/en-us/resources/</span><span class="invisible">blogs/spiderlabs-blog/its-raining-phish-and-scams-how-cloudflare-pages-dev-and-workers-dev-domains-get-abused/</span></a> )</p><p>But also *vercel.app, *.weebly.com, *.my.id, *.000webhostapp.com, *.github.io. and *.blogspot.TLD (TLD can be anything) are often used for scam sites.</p><p>Furthermore, domain names such as sites.google.com typically contain USER GENERATED CONTENT - which may be misleading.</p><p>NOTE: the above list is not complete! You may want to regularly check block lists like this one:<br><a href="https://raw.githubusercontent.com/mitchellkrogza/Phishing.Database/master/phishing-links-NEW-today.txt" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">raw.githubusercontent.com/mitc</span><span class="invisible">hellkrogza/Phishing.Database/master/phishing-links-NEW-today.txt</span></a></p><p>8) IDNs (International Domain Names) make Unicode domain names possible, benefitting huge amounts of people around the globe. For example, a valid (German) IDN is:<br> <a href="https://hopfenhöhle.de/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">hopfenhöhle.de/</span><span class="invisible"></span></a></p><p>However, IDNs are also used by scammers in order to deceive people, or by security people in order to warn us. For example, opening<br> https://www.аррӏе.com/<br>will not show the expected apple.com website (as of this writing, that site is not malicious). In fact, its actual link is:<br> <a href="https://www.xn--80ak6aa92e.com/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="">xn--80ak6aa92e.com/</span><span class="invisible"></span></a></p><p>If a "segment" of a domain name begins with "xn--", the entire name is called a Punycode domain name (Punycode uses a subset of ASCII characters permitted in DNS).</p><p>If browsers "suspect" a malicious website, most of them will, as a warning, show the Punycode alternative instead of the IDN. Unfortunately this trick is not reliable. OTOH, Firefox seems to always show "apple.com" in the example above.</p><p>If you (or your dad) uses Firefox (desktop) or Nightly on Android, you can make Firefox always display the Punycode variant (locate about:config in <a href="https://krebsonsecurity.com/2018/03/look-alike-domains-and-visual-confusion/comment-page-1/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">krebsonsecurity.com/2018/03/lo</span><span class="invisible">ok-alike-domains-and-visual-confusion/comment-page-1/</span></a> for instructions).</p><p>One can, for example, use<br> <a href="https://www.punycoder.com/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="">punycoder.com/</span><span class="invisible"></span></a><br>to translate between IDN and Punycode, and vice versa.</p><p>CONCLUSION<br>Of course this is only a fraction of what every internet-user should know to reasonably stay safe online.</p><p>HTH!</p><p>P.S. The text above was adapted from (in Dutch) <a href="https://tweakers.net/nieuws/216878/ministerraad-stemt-in-met-gebruik-gov-punt-nl-als-domein-voor-overheidswebsites.html?showReaction=19450852#r_19450852" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">tweakers.net/nieuws/216878/min</span><span class="invisible">isterraad-stemt-in-met-gebruik-gov-punt-nl-als-domein-voor-overheidswebsites.html?showReaction=19450852#r_19450852</span></a></p><p><span class="h-card" translate="no"><a href="https://infosec.exchange/@sassdawe" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>sassdawe</span></a></span> <br>cc: <span class="h-card" translate="no"><a href="https://infosec.exchange/@briankrebs" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>briankrebs</span></a></span><br>cc: <span class="h-card" translate="no"><a href="https://bird.makeup/users/samykamkar" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>samykamkar</span></a></span> (an automated account)</p><p><a href="https://infosec.exchange/tags/cyberSecurityAwareness" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cyberSecurityAwareness</span></a> <a href="https://infosec.exchange/tags/securityAwareness" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>securityAwareness</span></a> <a href="https://infosec.exchange/tags/awareness" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>awareness</span></a> <a href="https://infosec.exchange/tags/domainNames" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>domainNames</span></a> <a href="https://infosec.exchange/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DNS</span></a> <a href="https://infosec.exchange/tags/malicious" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>malicious</span></a> <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>phishing</span></a> <a href="https://infosec.exchange/tags/fake" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>fake</span></a> <a href="https://infosec.exchange/tags/fakeSites" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>fakeSites</span></a> <a href="https://infosec.exchange/tags/fakeWebSites" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>fakeWebSites</span></a> <a href="https://infosec.exchange/tags/IDN" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>IDN</span></a> <a href="https://infosec.exchange/tags/IDNs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>IDNs</span></a> <a href="https://infosec.exchange/tags/punycode" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>punycode</span></a> <a href="https://infosec.exchange/tags/safeonline" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>safeonline</span></a> <a href="https://infosec.exchange/tags/deceptive" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>deceptive</span></a> <a href="https://infosec.exchange/tags/misleading" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>misleading</span></a></p>