Lesson 2.11: Links and lookalike domains
A link has two parts: the text you see and the address it really opens. Phishing exploits the gap, and lookalike domains (extra words, typos, other top-level domains, characters from other alphabets shown through punycode) make the real address look right at a glance. In the lab you pull the real targets out of the reported message's HTML, compare them with the visible text, decode an internationalised domain, filter out every domain that isn't on the company's list, and find a tracking pixel that told the attacker the mail was opened.
16 min
You will learn to
- Tell a link's text from its target
- Recognise lookalike domain techniques
- Recognise punycode (xn--) domains
- Filter domains against an allowlist
- Explain tracking pixels
Key terms
- Link text vs target
- The visible words of a link and the address in its href attribute; they don't have to match.
- Lookalike domain
- A domain registered to resemble a real one.
- Punycode and IDN
- Internationalised domain names (IDN) allow non-Latin letters; in DNS they're encoded as punycode starting with xn--.
- Tracking pixel
- A tiny remote image whose download tells the sender that a message was opened, and from where.
- Credential phishing
- Phishing that leads to a fake login page to steal passwords and, increasingly, MFA codes or session cookies in real time (adversary-in-the-middle).
← Command line arguments and options · All lessons · IPv4 addresses, binary and the subnet mask →