{"id":13791893,"url":"https://github.com/kovart/forta-ens-spoofing","last_synced_at":"2026-04-22T10:34:01.086Z","repository":{"id":97652059,"uuid":"530782651","full_name":"kovart/forta-ens-spoofing","owner":"kovart","description":"🧐 The bot detects attacks in which someone registers ENS name visually similar to an existing one","archived":false,"fork":false,"pushed_at":"2023-05-05T10:35:30.000Z","size":725,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-16T11:46:03.633Z","etag":null,"topics":["bot","ens","forta","security","spoofing"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kovart.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2022-08-30T18:32:44.000Z","updated_at":"2023-01-30T18:17:25.000Z","dependencies_parsed_at":"2024-01-28T17:14:36.934Z","dependency_job_id":"3b2bbf8e-7c71-4b51-85f6-cce076b5c22d","html_url":"https://github.com/kovart/forta-ens-spoofing","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/kovart/forta-ens-spoofing","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kovart%2Fforta-ens-spoofing","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kovart%2Fforta-ens-spoofing/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kovart%2Fforta-ens-spoofing/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kovart%2Fforta-ens-spoofing/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kovart","download_url":"https://codeload.github.com/kovart/forta-ens-spoofing/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kovart%2Fforta-ens-spoofing/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32132566,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-22T08:34:57.708Z","status":"ssl_error","status_checked_at":"2026-04-22T08:34:55.583Z","response_time":58,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bot","ens","forta","security","spoofing"],"created_at":"2024-08-03T22:01:05.558Z","updated_at":"2026-04-22T10:34:01.070Z","avatar_url":"https://github.com/kovart.png","language":"TypeScript","funding_links":[],"categories":["I - Tools List"],"sub_categories":[],"readme":"# ENS Spoofing Bot\n\nENS Spoofing Bot detects attacks in which someone registers a name visually similar to an existing one.\n\n[Forta Protocol](https://forta.org/), which monitors blockchain events in real-time, together with this bot allows\nattacks to be detected before they happen or to minimize the damage from them. What's more, every ENS user will be able\nto receive an alert if it happened to their name.\n\nhttps://explorer.forta.network/bot/0x907254168eec2d601d2dc097e1dda89c80bbabb9d961c30bdf1eeeaa556dd99e\n\n[Table of spoofing techniques supported by the bot.](#spoofing-techniques)\n\n![ENS Spoofing Bot](/blob/preview.png)\n\n## The problem\n\nNames in the Ethereum Name Service are unique, but there are no restrictions on registering look-alike names that are\nvisually very difficult to distinguish from genuine ones.\nFor example, having a name `vitalik.eth`, an attacker can register a similar name by replacing the symbol\nlowercase L with uppercase i: vita**I**ik.eth.\nThe name is visually similar, but it is treated by the protocol as a completely different name, with its own hash, as\nwell as an address bound to it.\n\nThis type of attack is called [a homograph attack](https://en.wikipedia.org/wiki/IDN_homograph_attack).\nRegarding the ENS protocol, it can be performed in the following ways:\n\n- Substitution of character pairs i/I, i/j, O/0, w/vv, m/rn, which depending on the typeface, may be difficult or\n  impossible to distinguish;\n- Replacing ascii characters with visually similar ones from Unicode; for example, “faсebooсk.eth” uses the letters o\n  and с from Cyrillic;\n- Use of invisible Unicode characters;\n- Spoofing using uppercase letters; for example, bitcoin.eth may be spoofed as Bitcoin.eth.\n\nENS fights this attack pretty hard by normalizing names before they are registered,\nas well as warning against using non-ascii characters on its site.\nHowever, to save gas, such checks have been implemented off-chain, on the frontend side.\nAny user can register a name bypassing the official site by calling the protocol contract directly.\n\n## Spoofing Techniques\n\nBelow you will find examples of spoofing techniques that can be detected by this bot.\n\n| Original name | Spoofing name      | Technique           |\n| ------------- | ------------------ | ------------------- |\n| bitcoin.eth   | Bitcoin.eth        | Uppercase           |\n| danger.eth    | dаnger.eth         | Cyrillic Homoglyph  |\n| glukk.eth     | glükk.eth          | Unicode Homoglyph   |\n| wildcat.eth   | w1ldcat.eth        | ASCII Homoglyph     |\n| vitalik.eth   | vitalik\u0026#8203;.eth | Zero Width Space    |\n| wildcat100    | vv1lḍCatl00        | Multiple Techniques |\n\n## Supported Chains\n\n- Ethereum (1)\n\n## Alerts\n\n- AK-ENS-SPOOFING-ETH\n  - Fired when a transaction contains registration of a name that visually similar to an existing one\n  - Severity is always set to \"low\"\n  - Type is always set to \"suspicious\"\n  - Metadata:\n    - `originalName` - the name of the account that was potentially spoofed\n    - `originalAccount` - the address of the account that was potentially spoofed\n    - `impersonatingName` - the name of the account that registered a name similar to the one that already exists\n    - `impersonatingAccount` - the address of the account that registered a name similar to the one that already exists\n\n## Test Data\n\nNo data yet\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkovart%2Fforta-ens-spoofing","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkovart%2Fforta-ens-spoofing","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkovart%2Fforta-ens-spoofing/lists"}