Homograph attack

A homograph attack exploits characters that look the same, or nearly the same, to people but are different to computers. Internationalized domain names allow letters from Cyrillic, Greek and other scripts, so an attacker can register a domain that displays almost exactly like a brand's real domain. Similar tricks with plain ASCII characters, such as rn for m or the digit 0 for the letter o, are usually called homoglyph domains.

How it works

Every Unicode character has its own code point, so the Cyrillic "а" (U+0430) is a different character from the Latin "a" (U+0061), even when a font draws them identically. Domain names with non-ASCII characters are stored in DNS as punycode, an ASCII form that starts with xn--. Browsers apply rules to decide whether to show the Unicode form or the punycode form: domains that mix scripts or use characters easily confused with Latin letters are generally shown as punycode. These rules vary between browsers, email clients and messaging apps, and a lookalike can still appear in link text, in a QR code preview or in a sender name.

Example

An illustrative case: an attacker registers a domain that displays as examplebаnk[.]com, where the second "a" is actually Cyrillic. In DNS it is an xn-- string. In a phishing email, the link text shows the Unicode version. When clicked, the browser may display the punycode form, but many readers never look at the address bar.

How to spot it

• The address bar shows xn-- for a site that should be a plain brand domain.
• Letters look slightly different in shape, width or spacing.
• Copying the domain into a search box or text editor reveals unexpected characters.
• Your password manager does not offer to fill in credentials on the page.
• A certificate was recently issued for an unfamiliar xn-- name.

What brands can do

• Monitor new registrations and certificate transparency logs for internationalized and homoglyph variants of your brand, not only typo variants.
• Register key internationalized variants defensively where your registry allows it.
• Report active homograph domains for takedown and blocklisting.
• Encourage password managers and passkeys, which do not hand credentials to the wrong domain.

Phishvoid includes homograph variants in its checks and files takedowns when such domains host phishing; contact the team for details. See also Typosquatting and homoglyph domains explained.

Read more: Typosquatting and Homoglyph Domains Explained