提醒 V 友, 防不胜防的钓鱼网址

[liaa]

原始网站: epic.com

钓鱼网站: epic.com

打开后看地址栏，你觉得你能分辨的出来么？

[geelaw]

已经开始写一个用于自动检测和给出警告、选择性 trust 或 block 的插件了 - -

[aocif23]

详细页面里有提到修复方法

How to fix this in Firefox:
In your firefox location bar, type ‘ about:config ’ without quotes.
Do a search for ‘ punycode ’ without quotes.
You should see a parameter titled: network.IDN_show_punycode
Change the value from false to true.

chrome canary 已经修复,等稳定版更新

[liaa]

@geelaw 完成的话我可以帮你 append :)

[fangxing204]

牛逼啊，

[cnZary]

版本 60.0.3072.0 canary (64-bit)
点进去显示出来的是不一样的...

[Suddoo]

点进去钓鱼站的地址， chrome 提示真实地址了

[legend4]

Firefox 直接停止加载并有页面提示
This is a page to demonstrate a unicode vulnerability that currently exists in Chrome and Firefox. The domain above is not the real epic.com. It is actually the unicode domain: https://www.xn--e1awd7f.com/

This demonstrates how attackers can use phishing campaigns to imitate legitimate domains and fool users into entering sensitive data on a malicious website.

Please click here to return to the blog post on wordfence.com discussing this issue.

This site is not epic.com and has no affiliation with epic.com or Epic Systems Corporation. This page is not endorsed in any way by the owners of epic.com. To visit the real epic.com, you can click here.

但证书显示通过，是 Let's Encrypt 颁发的

[zmj1316]

@legend4 这不是停止加载吧，页面就是这个内容吧

[lilifenghao44]

@legend4 心好累，证书通过不一定是安全,要看看颁发给谁,颁发给什么域名.
现在只能在 ctrl+shift+I 的 security 看了.

以前有直接小锁看.

支付 /购物 /药品 等网站验证证书是非常必要的,特别是在陌生电脑上

[thekll]

IDNA
在 IDN 规范里应该强制要求浏览器等应用在显示 IDN 时将 puncode 编码的字符以某种直观的可辨识的方式表示，以示其为非 ASCII 码字符。

[kava]

晕，前面这么多提醒上钩的人还是不少。。

[tlze]

@aocif23 谢谢，方法有效。

[Yunhao]

@legend4 把这段英文看完你就会知道这段内容就是网站的正文，并不是浏览器提示。

[kingcos]

Safari 直接显示就是 https://www.xn--e1awd7f.com ，无论 macOS 还是 iOS

[Oucreate]

360 极速浏览器：地址栏显示的就是“ https://www.xn--e1awd7f.com ”。为 Chrome Windows 鼓掌！~

[salary123]

点击第二个进去显示这个。
This is a page to demonstrate a unicode vulnerability that currently exists in Chrome and Firefox. The domain above is not the real epic.com. It is actually the unicode domain: https://www.xn--e1awd7f.com/

This demonstrates how attackers can use phishing campaigns to imitate legitimate domains and fool users into entering sensitive data on a malicious website.

Please click here to return to the blog post on wordfence.com discussing this issue.

This site is not epic.com and has no affiliation with epic.com or Epic Systems Corporation. This page is not endorsed in any way by the owners of epic.com. To visit the real epic.com, you can click here.

[salary123]

@505243267 终于看懂了。字体。。太屌了，正常人根本就注意不到

[wavingclear]

钓鱼网站做的太不上心，以至于小白还以为是浏览器拦截了正在查看的网页……

[o00o]

јԁ.com 已注册

[zoffy]

厉害了我的域名