Packetbeat's DNS module should detect internationalized domain names and automatically decode the punycode to unicode and send the data as a new field.
As a user I'd like to be able to read back what the original domain name was when it was accessed by the someone on my network. Punycode encoded domain names don't resemble their unicode form at all.
For example if you see an internationalized domain name query for xn--pple-9na.com it's not obvious that this is likely a phishing attack until you see that xn--pple-9na.com is âpple.com.
Resources:
Packetbeat's DNS module should detect internationalized domain names and automatically decode the punycode to unicode and send the data as a new field.
As a user I'd like to be able to read back what the original domain name was when it was accessed by the someone on my network. Punycode encoded domain names don't resemble their unicode form at all.
For example if you see an internationalized domain name query for
xn--pple-9na.comit's not obvious that this is likely a phishing attack until you see thatxn--pple-9na.comisâpple.com.Resources: