Have you ever clicked a link that looked perfectly fine — only to realize later it wasn’t the site you thought it was? Maybe it looked like amazon.com, but it wasn’t Amazon at all.
That’s the trick behind something called an IDN homograph attack. It’s a fancy name for a simple scam: swapping normal English letters with lookalike letters from other alphabets. To your eyes it looks the same. To the internet, it’s a completely different website.
What exactly is an IDN homograph attack?
The internet doesn’t just speak English. Thanks to Internationalized Domain Names (IDN), people can register websites using characters from languages like Russian, Greek, or Chinese.
Scammers love this because some of those letters look identical to English ones. For example:
Real:
amazon.comFake:
аmazon.com(the first “a” is Cyrillic, not English)
Could you spot the difference at a glance? Most people can’t. And that’s the whole point.
Some examples in action
Here’s how common sites can be spoofed with a simple character swap:
Real domain | Fake lookalike | Punycode (the real identity) |
|---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
At first glance, they look like the real thing. But behind the scenes, browsers convert them into punycode (xn--…), which reveals their true identity.
How scammers use this trick
Scammers aren’t registering these domains for fun. They use them to:
Build fake login pages that steal your username and password.
Send phishing emails or texts that look trustworthy at first glance.
Spread malware disguised as software updates.
Bypass filters that only check for the exact spelling of trusted domains.
In other words, it’s all about tricking you into trusting what you see.
How you can stay safe
Slow down and look closely – If a link feels even a little suspicious, check it carefully.
Type or bookmark sites yourself – Don’t rely on random links in emails or DMs.
Make your browser show punycode – Many browsers let you turn on a setting that forces the
xn--...version to display.For businesses and developers:
Whitelist the real domains you trust.
Convert any user-provided URLs into punycode before allowing them.
Block or flag domains that mix scripts (Latin + Cyrillic together).
A quick tech peek
Here’s how you can check a suspicious domain in Python:
import idna
domain = "аmazon.com" # The first 'a' is Cyrillic
print(idna.encode(domain).decode())Output:
xn--mazon-3ve.comLooks like Amazon, but it’s not.
The bottom line
Homograph attacks are sneaky because they exploit the way our eyes work, not just how the internet works. A single fake character can mean the difference between shopping on Amazon and handing your credit card to a scammer.
So next time you’re about to click a link, pause for half a second. That tiny pause could save your data, your money, or even your identity.
For more such interesting blogs about cybersecurity do subscribe to THE CYBER TIMES NEWSLETTER !!!