Homograph Attacks
Phishing
Homograph attacks exploit the visual similarity between characters from different writing systems (Unicode scripts) to create domain names that appear identical to legitimate ones but use different underlying characters. For example, the Cyrillic letter "a" (U+0430) looks identical to the Latin "a" (U+0061) in most fonts, allowing attackers to register domains like "apple.com" using Cyrillic characters that visually match but resolve to a completely different server.
Internationalized Domain Names (IDNs) were introduced to support non-Latin scripts in web addresses, enabling billions of users to navigate the internet in their native languages. However, this legitimate feature has been weaponized by attackers who mix characters from different scripts to create deceptive domains. While modern browsers have implemented some defenses such as displaying Punycode (xn--) for mixed-script domains, these protections are inconsistent across applications and many users are unfamiliar with Punycode notation.
Homograph attacks are particularly insidious because they can fool even security-conscious users who have been trained to check URLs carefully. The visual deception operates at a level below normal human perception, making technical controls the primary line of defense. Certificate authorities have also been tricked into issuing SSL certificates for homograph domains, adding the padlock icon that many users associate with legitimacy.
Internationalized Domain Names (IDNs) were introduced to support non-Latin scripts in web addresses, enabling billions of users to navigate the internet in their native languages. However, this legitimate feature has been weaponized by attackers who mix characters from different scripts to create deceptive domains. While modern browsers have implemented some defenses such as displaying Punycode (xn--) for mixed-script domains, these protections are inconsistent across applications and many users are unfamiliar with Punycode notation.
Homograph attacks are particularly insidious because they can fool even security-conscious users who have been trained to check URLs carefully. The visual deception operates at a level below normal human perception, making technical controls the primary line of defense. Certificate authorities have also been tricked into issuing SSL certificates for homograph domains, adding the padlock icon that many users associate with legitimacy.
Key Statistics
- Researchers have identified over 8,000 possible homograph character substitutions across Unicode scripts.
- A Wandera study found that 25% of phishing domains use some form of character substitution or visual deception.
- IDN homograph attacks have been demonstrated against every major browser, with varying levels of mitigation.
- Farsight Security research shows hundreds of new IDN-based suspicious domains registered daily.
Prevention Strategies
- Configure enterprise browsers to display Punycode for all internationalized domain names to reveal character substitutions.
- Use DNS filtering solutions that detect and block known homograph domains targeting your organization.
- Proactively register IDN variants of your domain using common homograph substitutions to prevent attacker registration.
- Implement certificate transparency monitoring to detect when SSL certificates are issued for homograph variants of your domain.
- Educate users about homograph attacks and encourage navigating to sites via bookmarks or search rather than clicking links.
How Beacky Helps
Beacky detects homograph-based phishing sites by tracking content replication rather than domain names. Even when an attacker uses visually identical Unicode characters to create a perfect domain impersonation, Beacky's beacons embedded in your original content will fire from the fraudulent domain and expose the attack, bypassing the visual deception entirely.