You’ve probably seen those viral messages — “Adidas is giving away free shoes!” — sent through email, Facebook, or WhatsApp. The link looks real, the website feels legit, but before you know it, you’ve fallen into a trap.
This trick is called a Homograph Attack, and it’s one of the smartest phishing scams out there.
What Enabled This Attack?
In 2010, ICANN approved Internationalized Domain Names (IDN). This allowed website addresses to use non-English letters (like Arabic, Cyrillic, or Chinese characters).
This was great news for global users and businesses — finally, the internet wasn’t limited to English-only domains.
But it also opened the door for a new type of phishing scam: domains that look identical to real ones but are made with foreign characters.
What is a Phishing Attack?
Phishing is when attackers create fake websites that look like trusted ones, tricking users into entering their usernames, passwords, or banking details.
In the past, careful users could spot fake domains easily. For example:
✅ Real: www.paypal.com
❌ Fake: www.paypal.fakesite.com
But with IDN, spotting fakes is much harder. Look at this:
✅ Real: www.paypal.com
❌ Fake: www.рayрal.com
Notice the difference? The fake one uses Cyrillic letters that look like English “p” — but they’re not the same.
You can test this yourself by pasting these domains into a Punycode converter: https://www.punycoder.com
What is a Homograph Attack?
A Homograph Attack happens when attackers register domain names using lookalike letters from different scripts. These domains appear legitimate but are designed to steal sensitive information from unsuspecting users.
How to Protect Yourself
Here are a few ways to avoid becoming a victim:
Check for SSL 🔒 – Make sure the website has a secure lock icon in the browser bar.
Use Modern Browsers 🌐 – Chrome, Firefox, and other browsers can detect many punycode-based domains and warn users.
Know the Flaw ⚠️ – If all letters are from the same foreign script, some browsers may not flag it.
Install Extensions 🛡️ – Add security plugins that detect Punycode attacks. Search for “Punycode” in your browser’s extension store.
Final Thoughts
Homograph attacks are sneaky because they exploit how similar international letters look to English ones. The best defence is awareness and careful browsing.
Stay safe, double-check URLs, and when in doubt — don’t click that link.