An IDN homograph attack uses internationalised domain names with characters from other alphabets that look identical to Latin letters, creating fake domains that are visually indistinguishable from real ones.
How IDN homograph attacks work
Internationalised domain names (IDN) allow domains in Cyrillic, Greek, Chinese and other scripts. In DNS they are stored in an ASCII form called Punycode, which starts with xn--. Many characters in Unicode, however, look the same as Latin ones: the Cyrillic “а”, “е”, “о”, “р” and “с” are practically identical to their Latin counterparts. An attacker can therefore register a domain such as “аpple.com” written partly or fully in Cyrillic, which a browser or email client may display exactly like the original.
The problem was described in a 2002 paper by Evgeniy Gabrilovich and Alex Gontmakher. In 2017 researcher Xudong Zheng demonstrated a fully Cyrillic look-alike of apple.com (xn--80ak6aa92e.com) that Chrome and Firefox displayed as “apple.com”, prompting browser vendors to tighten their display rules.
Why homograph attacks matter
Homograph domains defeat the most common advice given to users – “check the address”. They are used in phishing links, fake login pages and email spoofing, and can even obtain valid TLS certificates, so the padlock icon appears. Similar tricks with look-alike characters are used in usernames, file names and source code. They are a more advanced form of typosquatting.
How to protect against homograph attacks
- Use a password manager – it will not autofill credentials on a look-alike domain.
- Keep browsers updated; modern browsers show Punycode for suspicious mixed-script domains.
- Open important sites from bookmarks instead of links in messages.
- Organisations should monitor registrations of homoglyph variants of their brands and block them in mail and web filters.
