200-201 Question 220
Single answerA security analyst is investigating suspicious activity on a corporate network. The analyst notices that a user frequently visits a URL with an unusual domain structure: 'http://xn--e1awd7f.xn--p1ai'. The analyst suspects it might be a malicious domain using an internationalized domain name (IDN) to mimic legitimate websites. What is the best immediate action the analyst should take to validate the URL's legitimacy?
- A
Use an online URL decoding tool to analyze the domain and check its ASCII representation.
- B
Block the domain immediately on the corporate firewall without further analysis.
- C
Run the URL through a public URL reputation service to check for known malicious behavior.
- D
Send a test email to the domain's administrative contact to verify its legitimacy.
Show answer and explanation
Correct answer: A
Explanation
Internationalized domain names (IDNs) can be used in phishing attacks by mimicking legitimate domains using non-ASCII characters. Analyzing the URL's ASCII representation with a decoding tool helps identify if the domain is using homograph techniques to deceive users. This is a crucial step in determining whether the domain is legitimate or malicious.
- A. Correct.
Using an online URL decoding tool to analyze the domain can help reveal its ASCII representation, making it easier to identify if the domain is malicious or attempting to mimic a legitimate one.
- B. Incorrect.
Blocking the domain immediately may disrupt legitimate services if the domain is not actually malicious. Investigation should occur before taking such actions.
- C. Incorrect.
While a URL reputation service can provide helpful information, it might not always detect domains that use IDN homograph attacks, making this approach less reliable in this scenario.
- D. Incorrect.
Sending an email to the administrative contact of a suspicious domain is not a recommended practice, as it could alert potential attackers or lead to further compromise.