Menu

Homoglyph

IDN Homograph Attacks

IDN Homograph Attacks: When Foreign Characters Create Fake URLs

< BLOG

IDN Homograph Attacks: When Foreign Characters Create Fake URLs

IDN homograph attacks are less straightforward than basic typosquatting because modern browsers apply safeguards to many suspicious internationalised domains. However, those safeguards are not universal, consistent, or a complete defence.

The URL looks correct. The characters are not.

Someone receives an email that appears to come from your company. The sender address looks right. The website link looks right. The page may even carry your logo, colours, products, and contact information.

But the domain is fraudulent.

The attacker has used a character from another alphabet that resembles a familiar English letter. At a glance, the URL looks genuine. On a phone screen or in a rushed inbox, the difference may be invisible.

You should not need to understand foreign alphabets, Unicode, Punycode, browser rules, or domain-registration policy to respond. That is why we built The TLD Project: to help businesses uncover impersonation domains, preserve evidence, and take professional action.

IDN Homograph Attacks

IDN stands for Internationalised Domain Name. IDNs allow domain names to use characters beyond the standard English alphabet, enabling web addresses in languages that use Cyrillic, Greek, Arabic, Chinese, Japanese, and other writing systems.

That is a legitimate and important feature of the internet. The risk arises because some characters from different writing systems look identical, or almost identical, to the letters used in English.

IDN Homograph Attacks use those visual similarities to create a fake domain name that resembles a real one. ICANN describes homograph spoofing as exploiting the visual or near-visual resemblance of characters and symbols, including characters from different languages.

For example, the English letter a and a Cyrillic character that looks like a are separate characters. A domain using the Cyrillic version is technically different, even if it appears identical in a browser or email.

This attack is also commonly called a Homoglyph Attack. The terms are closely related:

  • IDN Homograph Attack describes the use of internationalised domain characters to imitate another domain.
  • Homoglyph Attack is the broader term for using lookalike characters to create visual deception.

What a fake URL can look like

A criminal may register an address that appears to be:

yourbrand.com

But one or more letters may be different Unicode characters. The fake domain can be used in a link, embedded behind a button, placed in a QR code, or sent from an email address that looks as though it belongs to your business.

Sometimes a browser will display the technical encoded form of an internationalised domain, beginning with xn--. This encoding is called Punycode. Seeing xn-- in a URL can be a warning sign, but its absence does not prove a domain is genuine and its presence does not automatically mean a site is malicious.

The attacker may use the domain to:

  • Host a cloned version of your website.
  • Create a false Microsoft 365, Google Workspace, customer portal, or payment login page.
  • Send phishing emails that appear to use your company address.
  • Request invoice payments or fraudulent changes to supplier bank details.
  • Direct visitors to malware, counterfeit goods, scam adverts, or another fraudulent service.

ICANN’s security guidance notes that IDN homographs can be used to park domains, conduct phishing, distribute malware, and support other malicious activity.

Why normal checks can fail

“Check the web address” is good advice, but an IDN Homograph Attack is designed to defeat that check.

A careful customer may read the address, recognise your company name, and still be fooled because the false characters look genuine. This is particularly effective on small mobile screens, in a busy inbox, or where a link is shortened, hidden behind text, or accessed through a QR code.

For a business, the impact can include:

  • Stolen customer passwords, payment details, and personal information.
  • Staff credentials captured through cloned work-login pages.
  • Payment-diversion fraud aimed at customers or suppliers.
  • Fraud complaints and lost trust associated with your brand.
  • Multiple related domains registered to support a wider impersonation campaign.

The NCSC describes phishing as messages that link to websites which may contain malware or deceive people into revealing sensitive information or transferring money.

What to do

If you discover a suspected IDN Homograph domain, do not click around the site or enter information to investigate it. Copy the URL carefully, record the date and source, take screenshots, and preserve related emails—including full email headers where possible.

Document anything that proves impersonation: copied branding, a false login page, a payment request, a redirect, or messages claiming to represent your business. Check whether the domain is active on the web, configured for email, or being held for a future campaign.

The UK NCSC advises people not to click suspicious links or enter personal information into suspicious websites, and provides a route to report suspicious URLs for investigation.

The TLD Project helps businesses monitor brand-related domains across TLDs, identify possible IDN Homograph attacks and character-substitution risks, collect evidence, and begin a professional takedown

IDN Homograph Attacks
The TLD Project: Empowering everyone to take professional action.

Homoglyph Attacks

Homoglyph Attacks: Fake Domains That Look Like Your Real Website

< BLOG

Homoglyph Attacks: Fake Domains That Look Like Your Real Website

Someone copies a business website. The web address is similar, the design is almost identical and it can be easily mistaken for the real one. That’s a problem, that’s a fake domain and a fake website – Homoglyph attacks look like another business’s website.

It looks like your website address. It is not.

A customer reports a suspicious email from what appears to be your company. The sender address looks right. The link looks right. The website may even use your logo, colours, and layout.

But the address is not yours.

One or more characters have been replaced with lookalikes. To a person reading quickly, especially on a phone, the difference can be almost impossible to spot. This is not a simple spelling error. It is a deliberate attempt to make a fraudulent domain look genuine.

You do not need to learn Unicode, character sets, browser behaviour, or internationalised domain names before taking action. That is why we built The TLD Project: to help businesses identify suspicious domains, preserve evidence, and act against brand impersonation.

Homoglyph Attacks

A Homoglyph Attack uses characters that are visually identical or very similar to the letters and numbers in a legitimate domain name.

The technical term is often also called an IDN Homograph Attack. IDN means Internationalised Domain Name: domain names that support letters and characters beyond the English alphabet.

That capability is important. It allows people around the world to use domains in their own languages and writing systems. However, some characters from different alphabets can look almost identical.

For example, the Latin a used in English and the Cyrillic а may look the same to most people. They are different computer characters, so they can form different domain names.

A criminal can register a domain that visually resembles your real address, then use it to impersonate your business. ICANN identifies the visual resemblance between characters and symbols as the mechanism behind homograph domain spoofing.

How the deception works

Imagine your real website is:

yourbrand.com

An attacker may replace one character with a visually similar character from another script. On screen, the fake domain can look almost identical to your real address.

The risk increases when the domain is used in:

  • A phishing email that claims to come from your business.
  • A fake Microsoft 365, Google Workspace, customer portal, or payment login page.
  • A copied website that uses your brand logo and design.
  • An invoice or payment-change request sent to a supplier.
  • A text message, social-media advert, or QR code where the full address is difficult to inspect.

Some browsers try to reduce this risk by showing certain internationalised domains in their encoded format, often beginning with xn--. That is helpful, but it is not a complete defence. ICANN guidance recognises that browser protections have limitations and that reliable detection of IDN homographs often requires monitoring and human review.

Why it matters

A Homoglyph Attack is designed to defeat a sensible but limited security habit: checking the web address.

A customer may check a link and still be fooled because the address appears correct. A password manager may help by refusing to autofill credentials on a domain it does not recognise, while multi-factor authentication provides an additional barrier if a password is stolen. The NCSC recommends both password managers and MFA as part of phishing defence.

For a business, the result can be serious:

  • Customers enter passwords, payment details, or personal information into a fake website.
  • Staff disclose credentials through a cloned work-login page.
  • Suppliers receive fraudulent invoices or bank-detail-change requests.
  • Your brand becomes associated with a scam it did not create.
  • The attacker registers several lookalike domains to test different versions of your name.

Homoglyph attacks are often part of a wider domain impersonation campaign. The suspicious domain may also use typosquatting, a misleading TLD, added words such as “secure” or “login”, or a cloned site designed to copy your real business.

What to do

If you find a domain that appears to use lookalike characters, do not rely on a visual comparison alone. Record the domain exactly as it appears, preserve screenshots, save associated emails and full headers, and document copied branding, login pages, payment requests, redirects, or other evidence of abuse.

Check whether the domain is active on the web, configured for email, redirecting users, or sitting dormant. A domain with no visible website can still be part of an impersonation campaign. The TLD Project helps businesses monitor brand-related domains across TLDs, identify deceptive character substitutions, gather the right evidence, and begin the process of professional action. Homoglyph Attacks are increasing and it’s no longer an enterprise issue.

Homoglyph Attacks
The TLD Project: Empowering everyone to take professional action.