Nettfiske

使用 certstream SSL证书实时流来识别可能的钓鱼域名。它受到 Phishing Catcher 的启发。

用法

cargo run --release sample.json

示例

[Nettfiske]  Fetching Certificates ...
Homoglyph detected youtuḅe.com (Punycode: xn--youtue-tg7b.com)
Homoglyph detected youtuḅe.com (Punycode: xn--youtue-tg7b.com)
Homoglyph detected whatsapp.com (Punycode: xn--hatsapp-h41c.com)
Homoglyph detected whatsapp.com (Punycode: xn--hatsapp-h41c.com)
Homoglyph detected twiṫter.com (Punycode: xn--twiter-507b.com)
Homoglyph detected twiṫter.com (Punycode: xn--twiter-507b.com)
Suspicious paypal.com-secure.warn-allmail.com (score 72)
Suspicious applêid.àpplê.com.iosets.com (score 65) (Punycode: xn--applid-lva.xn--ppl-8ka7c.com.iosets.com)
Suspicious facebook.com-verified-id939819835.com (score 69)
Suspicious appleid.apple.com.invoice-qwery.gq (score 75)
Suspicious instagramaccountverifica.altervista.org (score 69)

用例

尝试检测使用Punycode和同形攻击来混淆域。当某些字符被替换为来自外文语言的类似字符时，Chrome、Firefox和Opera中的同形保护机制可能会失效。

示例

• microsoft.com⁄index.html.irongeek.com
• microsoft.xn--comindex-g03d.html.irongeek.com

第一个URL中的斜杠符号根本不是斜杠符号。另外，添加SSL证书可能需要几分钟，用户可以与旁边的域名锁一起感到更安全。

示例，尝试在Firefox中打开域名 https://www.xn--80ak6aa92e.com/。