Topic: Host-file to deal with phishing sites - page 2. (Read 642 times)

Very good that you shared this.

I had to look for quite some time on the URL to spot the difference and to be honest I wasn't able to.

I saw these two dots after I read about them. I am so happy that I have Binance platform installed

It is also a good thing to have Metamask and Malwarebytes extensions installed in your browser to protect from some phishing websites,
but scammers always create new websites and there is no 100% protection against this.

Few more websites to report phishing websites:

https://submit.symantec.com/antifraud/phish.cgi
https://www.comodo.com/home/internet-security/submit.php?url=http://sebiltv.com.tr/index/index.php?topic=5088858.0&&submissionType=1&source=1

And do not use the same or similar email and password when opening different accounts on different websites even after making your research, sites could be hacked and you would not want your entire online activity compromised. If possible have records of all your log in details on different accounts, especially if you're into cryptocurrency and could be using different exchanges at the same time.

Also, Have you most frequently visited sites bookmarked.

Allow me to quote myself, this is what started it:

And this is my addition to this topic:

---

---

For historical purposes:
Just 3 days later, theymos introduced the Merit system

Enable the punycode “detection” on your browser.

https://winaero.com/blog/enable-idn-punycode-firefox-address-bar/

It will go from this:



To this:

The most tricky phising website i've heard was this one. Looks like Binance.com but there are no "n". This is strange n with dot at the bottom.


source

How to deal with such a phishing adress? Those dots are almost unnoticable.

Phishing sites are one of the worst things, the you never want to be trapped, because you will lose your identities and money too in case you use same emails and same passwords over different platforms, includes phishing sites.

Rules to fight against phishing sites:
- Never click on links in emails or any groups sent by strangers.
- Never create accounts on newborn, strange sites/ forums if you do not make your own research about those sites.
- For already known phishing sites, there are steps to add them into host-files to avoid probability that your browsers will open those sites, by you, your wife/husband, children, whoever.
BTW, I appreciated the post of o_e_l_e_o.
Read more: https://support.rackspace.com/how-to/modify-your-hosts-file/


So, what is new in this thread?
Steps to add phishing sites, and turn them off are above, what we need is list of phishing site.

So, if you know any phishing sites, please leave them here, I will add them to the list. I hope that we all will make a long list of phishing sites.

Someone did it, but you still can contribute to my list.
SteveBlack's hosts
Report phishing site through the page

Disable punny coded phishing sites

Source: https://winaero.com/blog/enable-idn-punycode-firefox-address-bar/
What is punny code?
Punycode is a special encoding used to convert Unicode characters to ASCII, which is a smaller, more restricted character set than Unicode. Punycode is used to encode internationalized domain names (IDNs) as a defense against address spoofing. Firefox allows enabling IDN punycode instead of non-Latin letters and Unicode symbols. This can be very useful, as you can find out if the currently opened web page is a phishing site or just a non-official mirror of some web site which you would like to avoid.
Ex: A phishing site of Binance that use punny code

At first glance, the addresses look very similar. Some users may not pay attention to the small dots below the "n" letter, which are there because it is a unicode symbol 'n with a dot below it' (U+1E47). This way, phishing web sites may trick you and make you believe that you are visiting the official genuine site.

For advanced protection, you can enable IDN Punycode protection in Firefox. With the option enabled, the address becomes like this:

Obviously, it doesn't look like the right web address any more.

If you find this feature useful and would like to enable it, here is how.

To enable IDN Punycode in Firefox Address Bar, do the following.
Read more here

---

Punnycode attacks


IDN homograph attack

Should-read threads:
What to do to avoid phishing sites
[LEARN] Phishing Quizzes - Beginners & Experts