Adding 'Domain Name Homograph' into learning resources at Detecting, Investigating and Tracking Malicious Infrastructure

[XavCC]

I've noticed that there's a case missing that's not very common but has a high potential for harm.
Homograph International Domain Names (IDNs) for phishing purposes.
One example among many possibilities:

exampʟe[.]com (xn--exampe-0dd[.]com)

A message or an email, received with such a homograph brings a great deal of confusion and therefore risk to the person targeted.
Although Internet and software players have put in place a number of mitigating parameters, this is still a common occurrence. And because it is little known, it has a high potential for causing harm.

Before going into the aspects of writing to complete the resources and before the technical and methodological details, I need to know where to put this scenario.
I was thinking of putting it here: …/module-5

But I'm not sure. Perhaps a dedicated file/module needs to be created, or is that too much?

[blazman]

Hi @XavCC I'd say .../module-6 would be a better home for it since it is about the contents of phishing emails and the different types of threats they contain (compared to Module 5 which is about email headers).

Specifically it could go into an H3 right below ### Identifying Potential Threats: Embedded Images and Tracking Pixels as another H3 section. That's my initial thinking!

I think one longer term improvement we could make to the learning path is to make it clearer that phishing will commonly come through other means outside of email and can be analyzed in similar ways (e.g. instant messengers). For now it's more framed around emails.

Thanks for your contribution!