HackBlue

Labs / Email and phishing

Lookalike domain triage

New registrations that resemble your brand: decode punycode, name the trick each one uses, and decide which are ready to send phishing mail.

  • Interactive lab
  • Intermediate
  • 5 steps
  • 0 of 5 solved

Goal

A monitoring feed flagged six new registrations that resemble contoso.example. Decode each name, check its DNS, and decide which one is ready to send phishing mail today.

Punycode names start with xn--. Decoding shows the Unicode the browser or mail client would display.

Registered in the last 72 hours

Tools

contoso-login.exampleregistered 2026-03-13
As written
contoso-login.example
MX
mx.contoso-login.example
SPF
none
Web
Clone of the Contoso sign-in page

Can receive replies, but has no SPF record, so its mail is likely to land in spam or be rejected.

Steps

  1. 01xn--cntoso-wqf.example decodes to something that looks exactly like contoso.example. Which script does the odd letter come from?

  2. 02Which domain is already set up to send mail that passes SPF?

  3. 03Which technique does cnotoso.example use?

  4. 04contoso.secure-verify.example hosts a sign-in clone. Which registered domain controls it?

  5. 05What is the most useful step for the mail-ready homograph today?