search

elceef / dnstwist

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation
https://dnstwist.it
Apache License 2.0
4.81k stars 764 forks source link

Adding common dyslexia homoglyphs #85

Open grk- opened 5 years ago

grk- commented 5 years ago

See real attacks based on exploiting dyslexia

elceef commented 5 years ago

Do you mean the reading disorder? Could you please elaborate more?

grk- commented 5 years ago

Dyslexia takes various shapes and reading difficulties in just one of them. A common case is people misreading b d p and q letters, h and n, c and e (this one was already covered in your initial code). My pull request just address a small portion of those reading disorders. Note that some fonts are more misleading than others. I've a case where such a substitution was made intentionally to mislead a person probably dyslexic. This change on my copy of the code already pinpointed few domains controlled by bad guys, which were not identified in the master code of dnstwist.

elceef commented 5 years ago

Do you have any research paper on the topic? Are you comfortable with sharing domain names that you have discovered?

grk- commented 5 years ago

I've found limited confirmations of my acquaintances experiences on Wikipedia[1][2], plenty of education support sites, but not yet full fledged research precisely describing the characters being substituted (there are way more than those I proposed). I can privately share what I've discovered yes.

[1] https://en.wikipedia.org/wiki/Dyslexie#Font [2] https://en.wikipedia.org/wiki/Characteristics_of_dyslexia#Reading_and_spelling