IDN homograph

An IDN homograph is an internationalized domain name that visually resembles another name, often a well-known brand or service, because it uses characters that look identical or nearly identical from different alphabets. This technique exploits the fact that certain Latin, Greek, and Cyrillic letters share similar shapes, even though their Unicode codes differ. A user may read the name as the authentic one without realizing the substitution has occurred. The risk is especially high in email links, messages, and pages requesting passwords, financial data, or access codes.

IDN, Unicode, and Punycode

IDNs are legitimate and allow domain names to be written in local languages. The DNS system represents them using Punycode, an ASCII encoding that often begins with "xn--". Browsers decide whether to display the Unicode form or the encoded version based on security rules and scripts. An homograph is not a technical encoding error: the name can be legally registered and may even have a valid TLS certificate. The issue lies in perceptual similarity and how the name is used to mislead users.

Attackers can combine characters from multiple alphabets, replace single letters, or use diacritics and near-identical glyphs. The address bar might obscure differences on small screens, and some fonts make characters even more alike. The presence of an HTTPS lock does not confirm brand authenticity—it only indicates an encrypted connection to the displayed domain, not that the legitimate organization controls that name. Users must evaluate the full hostname and context of the link.

Detection and Defense

A technical check can convert a name into Punycode and compare characters, scripts, and Unicode sequences. Organizations can monitor new registrations resembling brands or corporate domains, set up alerts, and analyze suspicious emails containing links. These tools may generate false positives: legitimate names in different languages might appear similar without malicious intent. Classification must be based on usage, content, targeting, and context—not just visual similarity.

Users should access critical services via bookmarks or official apps, avoid unexpected links, and verify the hostname before authenticating. Phishing-resistant multi-factor authentication reduces the value of stolen passwords, while password managers may refuse to fill credentials on a different domain. None of these measures replace device and email security checks. A company should use consistent domains, implement email authentication, provide regular training, and establish reporting and rapid response processes.

Reporting and Rights

If a domain is identified for impersonation, preserve the URL, date, screenshots, and any original message. It is not advisable to enter credentials or download files to gather evidence. Reporting can be sent to the registrar, hosting provider, browser, email provider, or authorities depending on the type of abuse. For registered trademarks, dispute procedures may exist, but outcomes depend on rights, intent, use, and TLD rules. A similar name does not automatically constitute a violation.

In summary, an IDN homograph is a specific case of deceptive similarity based on Unicode characters. Defense combines secure display, link verification, monitoring, and reporting procedures. It is essential to distinguish legitimate international alphabet usage from demonstrable abuse.