Enhancing Domain Name Security: Proposal for Fraudulent Domain Detection

[dpgiakatos]

Is your feature request related to a problem? Please describe.

There are multiple ways to write a domain name due to the use of different languages. For example, the domain name iij.ad.jp can be mistakenly written as iij.әd.jp, where the English letter a is replaced with the Cyrillic letter ә. Although these letters look similar, this substitution can lead users to click on a link that directs them to a phishing website.

Describe the solution you'd like

I propose adding a comprehensive list of fraudulent domains that do not correspond to verified organizations. By "verified," I mean organizations whose true domain names are known. This could involve of adding a new dataset.

Describe alternatives you've considered

One alternative is to develop a validator (such as a browser plugin or website or a new page in IHR website) that uses the IYP (Internet Yellow Pages) to verify whether a domain name is valid. The IYP contains the true domain names of various entities, including organizations and companies.

[dpgiakatos]

One solution to this issue is the addition of a PhishTank database. The creators provide a downloadable database in the following format:

array(
    array(
        'phish_id' => 123456,
        'url' => 'https://www.example.com/',
        'phish_detail_url' => 'http://www.phishtank.com/phish_detail.php?phish_id=123456',
        'submission_time' => '2009-06-19T15:15:47+00:00',
        'verified' => 'yes',
        'verification_time' => '2009-06-19T15:37:31+00:00',
        'online' => 'yes',
        'target' => '1st National Example Bank',
        'details' => array(
            array(
                'ip_address' => '1.2.3.4',
                'cidr_block' => '1.2.3.0/24',
                'announcing_network' => '1234',
                'rir' => 'arin',
                'detail_time' => '2006-10-01T02:30:54+00:00'
            )
        )
    )
)

To import this new database into the IYP, we need to create a new node/relationship.

P.S. While we can download the database without an API key, the providers recommend having one. Without an API key, they may limit our access. However, they have temporarily stopped the creation of new accounts, so we may need to contact them to request access.

More information on this link: https://phishtank.org/developer_info.php

@InternetHealthReport/iij members, what’s your view about this approach?

[m-appel]

As per the new workflow this should've been a discussion instead :P

But apart from that looking at the data I think we can only link the data to the announcing network. I don't see how we can link to organizations in our graph, since the target name probably does not match precisely anything we have. (Also I just looked at the current dump and 94% of the 67k entries have Other as the target).

So from a use-case perspective I guess you could find which network hosts the most phishing websites according to this dataset.

[dpgiakatos]

Now, it is a discussion 😛