<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>Hi wkitty42,</div>
<div> </div>
<div>thanks for the reply.</div>
<div>This punycode indeed is a good startr.</div>
<div> </div>
<div>I found a website that converts punycode to plain text and apparently only one of five domains seems to be punycode.</div>
<div> </div>
<div>Please don't click them, they are considered to be malicious:</div>
<div>address=/0----0.0----0.1596.hk/<br/>
address=/0------------0-------------0.0n-line.info/<br/>
address=/9------9.tk/<br/>
address=/apple.com----macupdate.info/<br/>
address=/xn----ylbefiabzfr6bln8a2ef.gr/</div>
<div> </div>
<div>The last one is in fact valid puneycode. It has kyrillic/greek letters.</div>
<div> </div>
<div>The first 4 domains seems to be none puneycode, maybe only made to distract scanner and possibly maybe even dns-blacklists?</div>
<div> </div>
<div>I didn't try to use the converted sample yet, since problems starting dnsmask already occur with the 1st domain.</div>
<div>Also I don't know how to convert possible ouneycode by script.</div>
<div>
<div> </div>
<div>Anyway, thank you very much for the heads up.</div>
<div> </div>
<div>
<div name="quote" style="margin:10px 5px 5px 10px; padding: 10px 0 10px 10px; border-left:2px solid #C3D9E5; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="margin:0 0 10px 0;"><b>Gesendet:</b> Montag, 08. März 2021 um 13:49 Uhr<br/>
<b>Von:</b> wkitty42@gmail.com<br/>
<b>An:</b> dnsmasq-discuss@lists.thekelleys.org.uk<br/>
<b>Betreff:</b> Re: [Dnsmasq-discuss] Problem with domain names containing 3 or more minus in a row</div>
<div name="quoted-content">On 3/8/21 3:31 AM, PsyclopS@web.de wrote:<br/>
> Therefore I use lists called "Shalla's Blacklists" that happen to have domains<br/>
> with multiple minus in a form like this X----X.X----X.1596.hk. (This is not the<br/>
> actual domain, since it is malicious I changed one letter to X).<br/>
<br/>
eWAG in progress:<br/>
on first read, "punycode" comes to mind... it appears that you are trying to<br/>
block domains which use non-latin characters in their domain names... have you<br/>
tried using the actual characters instead of the punycode equivalents?<br/>
<br/>
for more info on "punycode" here's a link i found in a quick search...<br/>
<a href="https://krebsonsecurity.com/2018/03/look-alike-domains-and-visual-confusion/comment-page-1/" target="_blank">https://krebsonsecurity.com/2018/03/look-alike-domains-and-visual-confusion/comment-page-1/</a><br/>
<br/>
personally speaking, i don't know how dnsmasq works with non-latin character<br/>
domain names... i don't recall reading anything specific about it in the last<br/>
years i've been on the list... i look forward, with anticipation, on further<br/>
discussion about this and how dnsmasq can work with the original and punycode<br/>
formats for the same domain name...<br/>
<br/>
--<br/>
NOTE: No off-list assistance is given without prior approval.<br/>
*Please keep mailing list traffic on the list unless*<br/>
*a signed and pre-paid contract is in effect with us.*<br/>
<br/>
_______________________________________________<br/>
Dnsmasq-discuss mailing list<br/>
Dnsmasq-discuss@lists.thekelleys.org.uk<br/>
<a href="https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss" target="_blank">https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss</a></div>
</div>
</div>
</div>
<div> </div>
<div class="signature"> </div></div></body></html>