Homograph Attack
An attack exploiting visually identical characters from different Unicode scripts to create deceptive domain names that appear legitimate.
A homograph attack, also known as an internationalized domain name (IDN) homograph attack, exploits the visual similarity between characters from different writing systems to create domain names that appear identical to legitimate ones but are technically different. For example, the Cyrillic letter "a" (U+0430) looks identical to the Latin letter "a" (U+0061) in most fonts, but they are distinct Unicode characters. An attacker can register a domain using Cyrillic characters that visually matches a well-known Latin-script domain, creating a perfect visual impersonation.
The attack is made possible by the internationalized domain name system, which allows domain names to contain Unicode characters beyond the basic Latin alphabet. While this feature enables internet users worldwide to create domains in their own scripts, it also creates an exploitation vector. An attacker could register "apple.com" using a Cyrillic "a" and a Latin "pple.com" — the resulting domain would display identically in many browsers and email clients but would resolve to the attacker's server. The underlying Punycode representation (xn--pple-43d.com) would reveal the deception, but users never see the Punycode form under normal circumstances.
Modern browsers have implemented various mitigations, such as displaying Punycode instead of Unicode when a domain mixes scripts or uses characters from scripts not matching the user's system language. However, these protections are inconsistent across browsers and can fail in certain edge cases. The threat remains particularly acute in emails and messaging applications, which may not apply the same display restrictions. Effective defense combines browser-level protections, email security filters that detect homograph domains, brand monitoring for IDN registrations, and user awareness about this subtle attack vector.
The attack is made possible by the internationalized domain name system, which allows domain names to contain Unicode characters beyond the basic Latin alphabet. While this feature enables internet users worldwide to create domains in their own scripts, it also creates an exploitation vector. An attacker could register "apple.com" using a Cyrillic "a" and a Latin "pple.com" — the resulting domain would display identically in many browsers and email clients but would resolve to the attacker's server. The underlying Punycode representation (xn--pple-43d.com) would reveal the deception, but users never see the Punycode form under normal circumstances.
Modern browsers have implemented various mitigations, such as displaying Punycode instead of Unicode when a domain mixes scripts or uses characters from scripts not matching the user's system language. However, these protections are inconsistent across browsers and can fail in certain edge cases. The threat remains particularly acute in emails and messaging applications, which may not apply the same display restrictions. Effective defense combines browser-level protections, email security filters that detect homograph domains, brand monitoring for IDN registrations, and user awareness about this subtle attack vector.
Examples
- An attacker registers a domain using Cyrillic characters that appears identical to "apple.com" and hosts a fake Apple ID login page.
- A phishing email contains a link to a homograph domain mimicking a bank's website, undetectable by visual inspection.
- A fake "paypal.com" using mixed Latin and Cyrillic characters is used to steal payment credentials.
Prevention
- Use a browser that displays Punycode for domains containing mixed-script Unicode characters.
- Implement email filtering that detects and flags messages containing homograph domain links.
- Monitor IDN registrations for domains that visually impersonate your brand using homograph characters.
- Train users to bookmark important sites and avoid clicking links in unsolicited messages.