Homograph attack: when an a isn't an a

In 2017 security researcher Xudong Zheng published a demo site whose address appeared as apple.com in Chrome, Firefox and Opera. Not a single letter in it was Latin. He had registered a domain made of Cyrillic characters that happen to look the same. The idea wasn’t new, but the demo showed that the browser rules of the time weren’t enough. A homograph attack works because people read shapes and computers read code points.

What is a homograph attack?

Homographs are characters that look alike but are different. The Latin a (U+0061) and the Cyrillic а (U+0430) are practically indistinguishable on screen. To DNS they are two different characters, so the domains are different too.

This is possible because of internationalised domain names (IDNs). Since their introduction, domains can contain accents and entire non-Latin scripts. That is real progress for the majority of the world that doesn’t write in English, and at the same time an opening for forgeries.

Punycode: the real spelling of a domain

DNS itself only knows letters, digits and hyphens. Internationalised domains are therefore converted to an ASCII form called punycode, recognisable by the xn-- prefix. You can try it with Python:

python3 -c "print('аррӏе'.encode('idna'))"

b'xn--80ak6aa92e'

The five characters in quotes are Cyrillic. What looks like “apple” is xn--80ak6aa92e in DNS. With an ordinary accented name:

python3 -c "print('müller'.encode('idna'))"

b'xn--mller-kva'

The second is harmless, the first is the problem. Both start with xn--. Punycode alone isn’t an alarm, but it shows what is actually registered.

When browsers show punycode instead of letters

The major browsers tightened their rules after 2017. Chrome runs each domain label through a series of checks and shows punycode if any of them trips. According to the Chromium documentation, these include:

Chrome also shows a full-page warning when an address looks confusingly similar to a well-known domain or one you visit often. All these checks run locally in the browser.

Firefox uses a rule set based on Unicode’s UTS #39 and shows punycode for labels that mix scripts in disallowed ways. Setting network.IDN_show_punycode to true in about:config makes it display every IDN as punycode.

These rules catch the known patterns well. They are still heuristics, so don’t assume every forgery will appear as xn--, especially in email clients and messengers, which display links differently from the browser.

Where homographs still slip through

The browser address bar is the best-defended place. The weak spots are where nobody reads the address carefully:

• Email clients and messengers that show the link text rather than the target URL.
• Lookalikes within the Latin alphabet, such as rn for m or zero for o. Strictly that’s typosquatting rather than a homograph attack, but it works the same way.
• Email senders, where the domain hides behind the display name.
• QR codes, whose destination you rarely check before opening.

How to take any suspicious domain apart is covered in spot a phishing domain.

Protecting yourself as a user

A few habits catch almost everything. Open logins and banking from bookmarks or by typing, never from email links. Use a password manager that fills credentials only on the exact saved domain; if it offers nothing on a site that looks familiar, look harder. And use passkeys or security keys as your second factor, because they are bound to the genuine domain and simply don’t work on a lookalike.

If you find such a site, report it. How is covered in report a phishing site.

Monitoring homographs of your brand

If you run a brand, you want to know when someone prepares a forgery. The open-source tool dnstwist generates homoglyph variants of your domain along with typos, shows them in Unicode and punycode, and tells you which are registered and whether they have a website or mail server.

Certificate Transparency logs are the second source. Almost every phishing site needs a TLS certificate, and every publicly trusted certificate is logged. A new certificate for a punycode lookalike of your domain is an early warning, often before the first email goes out.

And your customers are a third. Publish an address where they can forward suspicious emails. People who see phishing reports every day often spot a new campaign hours before any tool does.

Protecting your domain as an owner

Whether a homograph of your domain can be registered at all depends on the extension. Each registry decides which characters it allows and whether scripts may be mixed in one label. For a well-known brand it’s worth checking which IDN variants are possible under the extensions that matter to you.

You can check the obvious spellings of your name with a domain search for your brand. Conditions per extension are on pages such as the one for .com domains, and the full price list shows what a handful of defensive registrations would cost per year. For brands that handle payments, the two or three most obvious forgeries are usually worth the fee.