IDN and Homograph Phishing: When the Domain Looks Right But Is Wrong

Phishing is not only misspelled domain names. Homograph attacks abuse visually similar characters from different Unicode scripts—Cyrillic “а” instead of Latin “a”—so the browser’s address bar looks identical to a legitimate site while resolving to an attacker-controlled hostname.

How IDN and Punycode Fit In

Browsers support internationalized domain names (IDNs) so people can use native scripts. Those names are represented in DNS using Punycode (xn--…). Many users never see the Punycode form; they see a friendly label. Attackers register domains that display like paypal.com or microsoft.com but encode to a different underlying ASCII name.

Why It Bypasses Casual Checks

Security awareness training often says “check the URL.” Homograph phishing targets exactly that habit: the string looks right. Combined with HTTPS, a polished login page, and urgency in the email or message, click-through rates stay high.

Defensive Measures

1. Browser and OS policies: Prefer browsers that show Punycode or warn on mixed-script domains; keep clients updated.
2. Email and web gateways: Detect newly registered IDNs, homograph clusters, and look-alikes of your brand with reputation and visual-similarity feeds.
3. User education: Teach “don’t trust the address bar alone”—use bookmarks for sensitive apps and verify out-of-band when wiring money or resetting credentials.
4. Brand protection: Monitor registrations that spoof your domains and file takedowns with registrars where policy allows.

For Security Operations

Alert on:

• First-seen domains with high visual similarity to internal or SaaS allowlists.
• Logins or OAuth flows where the redirect host is an IDN or recent registration.
• TLS certificates issued for confusable brand strings.

Conclusion

Homograph and IDN phishing exploit human perception and Unicode normalization. Technical controls (reputation, gateway rules, browser behavior) plus assume-breach thinking on authentication flows close the gap when the URL “looks” correct.