IDN homograph attack

Last reviewed: September 17, 2026

IDN Homograph Attack

An Internationalized Domain Name (IDN) homograph attack is a type of phishing attack that exploits the visual similarity of characters in different scripts to deceive users into visiting malicious websites. This attack leverages the fact that many characters from different alphabets look alike or identical to Latin characters used in domain names. As of October 2023, IDN homograph attacks continue to pose a significant threat to internet users, as they can be used to impersonate legitimate websites, to credential theft and other malicious activities.

Overview

IDN homograph attacks exploit the visual similarity of characters from different writing systems to create deceptive domain names. These attacks take advantage of the Unicode standard, which allows for the representation of a wide array of characters from various languages in domain names. Attackers register domains with characters that visually resemble those in legitimate domains, tricking users into believing they are visiting a trusted website. This technique is commonly used in phishing campaigns to harvest sensitive information such as login credentials and financial data.

How it works

IDN homograph attacks rely on the use of Unicode characters that look similar to or are indistinguishable from standard ASCII characters. For example, the Cyrillic character "а" (U+0430) looks identical to the Latin "a" (U+0061). An attacker might register a domain like "аррӏе.com" using Cyrillic characters that resemble the Latin characters in "apple.com." When users visit the deceptive domain, they may not notice the subtle differences and may inadvertently provide sensitive information to the attacker.

The process typically involves:

Domain Registration: Attackers register a domain name using visually similar Unicode characters.
Phishing Setup: The malicious domain hosts a website that mimics the appearance of a legitimate site.
User Deception: Users are directed to the fake site through phishing emails, social engineering, or other attack vectors.
Data Harvesting: Users unknowingly enter their credentials or personal information, which is then captured by the attacker.

Observed use

IDN homograph attacks have been observed in various phishing campaigns targeting popular online services, financial institutions, and e-commerce platforms. Attackers often use these deceptive domains to impersonate well-known brands, aiming to steal login credentials, credit card information, and other sensitive data. The technique has been employed in both targeted attacks against specific organizations and broader campaigns affecting a wide range of users.

Detection

Detecting IDN homograph attacks can be challenging due to the subtlety of the character differences. However, several strategies can help identify these threats:

Browser Warnings: Modern web browsers often include features that warn users about potentially deceptive domains.
Domain Analysis Tools: Security tools can analyze domain names for suspicious Unicode characters and alert users or administrators.
User Education: Educating users about the risks of IDN homograph attacks and encouraging them to verify URLs carefully can reduce the likelihood of falling victim to such attacks.

Mitigation

Mitigating the risk of IDN homograph attacks involves a combination of technical measures and user awareness:

Domain Registration Policies: Organizations can register multiple variations of their domain names, including potential homographs, to prevent attackers from exploiting them.
Browser Security Features: Encouraging the use of browsers with built-in security features that detect and warn about IDN homograph attacks can protect users.
User Training: Regular training sessions to raise awareness about phishing and the importance of verifying URLs can help users recognize and avoid deceptive domains.