xn--" punycode domain phish slipped past gateway url scan undetected
Detects punycode domain phishing that slipped past URL scanning, by decoding IDN domains and comparing them with protected brands. Use when a link uses an xn-- encoded domain to impersonate a brand. Not for legitimate internationalised domains with no brand resemblance.
TL;DR
An xn-- prefix means the domain is an internationalised name encoded for DNS. Scanners that store the encoded form and display tools that render the decoded form can each miss what the other sees, and attackers exploit the split to impersonate brands. Decode every suspicious IDN, compare the decoded form against your protected brands for confusable characters, and set policy to flag IDN links that decode to brand lookalikes.
"xn--" punycode domain phish slipped past gateway url scan undetectedUse this when
- A delivered link contains an xn-- domain that renders as a familiar brand.
- Gateway logs show the encoded domain with a clean verdict.
Not for this skill when
- The IDN decodes to an unrelated legitimate foreign-language brand. Review, do not auto-block.
- The impersonation is in the sender domain headers. Handle that as domain impersonation.
Steps
- Extract the encoded domain from the message and decode it with an IDN tool, recording both forms. Verify: decoded and encoded forms are documented.
- Compare the decoded characters with the real brand domain code point by code point to find substituted characters. Verify: the confusable substitutions are identified.
- Block the encoded domain in tenant and proxy lists, since blocking must match the form systems actually resolve. Verify: a test lookup is blocked.
- Enable or add detection for IDN domains in inbound links, with brand-similarity checks on the decoded form. Verify: the control covers decoded comparison, not only raw string matching.
- Search historical mail for other xn-- links and review each decoded target. Verify: no other live impersonation links remain delivered.
Variant phrasings
xn-- punycode phishing link decode block
The decode and block variant.
idn homograph url scanning gateway setting
The scanning setting variant.
Compatibility: RFC 3492 punycode, Defender and gateway IDN handling, browser IDN display policies.
Why it happens
Punycode exists to carry Unicode names through ASCII DNS. Security tooling split on which form it inspects creates a blind spot exactly where visual impersonation lives: in the decoded rendering the victim reads.
Edge cases / pitfalls
- Some browsers already refuse to render mixed-script IDNs as the brand, but mail clients vary. Do not rely on the client.
- Maintain a watchlist of your brands decoded confusable variants for proactive registration monitoring.
- Legitimate IDN use is common in non-English markets. Scope aggressive actions to brand resemblance.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_8LBEdOEBC8qn9nwa-IAFUA