Homograph Attack

A homograph attack abuses internationalized domain names to imitate a trusted domain with characters that look the same but are different code points, usually from another script. Because Unicode contains many visually identical letters, such as Latin “a” and Cyrillic “а”, an attacker can register a name that renders exactly like a bank or software vendor’s domain and use it in phishing links or email. Underneath, the DNS only carries ASCII: the IDNA framework in RFC 5890 maps each Unicode label (the U-label) to an ASCII A-label beginning with xn—, using the Punycode encoding from RFC 3492. That A-label is where the deception shows: a lookalike domain that seems to be plain Latin text has an xn— form that does not match the real one.

How are homograph lookalikes detected?

Unicode Technical Standard #39 defines the main tools. Its skeleton() function maps characters to shared prototypes, so two strings with equal skeletons are confusable. It separates mixed-script confusables, which share no script, from whole-script confusables, where each string is also written in a single script, and it defines restriction levels such as Highly Restrictive that limit which scripts may mix in one identifier. Browsers and registries apply rules of this kind to decide when to show the xn— form instead of Unicode; Google Chrome, for example, documents its IDN display policy, under which some domains are shown in Punycode to protect against homograph attacks. Unlike typosquatting, which waits for a user to mistype a name, a homograph domain is read correctly and still deceives.

AdminKit’s IDN homograph check shows any domain’s Punycode and Unicode forms side by side and flags mixed scripts and confusable characters. Homograph attacks are part of AdminKit’s DNS cluster; the full AdminKit glossary lists other related terms.