Fraud · 7 min read
Homoglyph attacks: when a domain name looks exactly like yours
A Cyrillic а looks exactly like a Latin a. Here is how homoglyph attacks exploit internationalised domain names, how Punycode unmasks them, and how to protect your business.
A homoglyph attack replaces one or more characters of a domain name with characters that look the same but are different: a Cyrillic letter instead of a Latin one, a zero instead of an o. The result can be impossible to tell apart from the real domain, in an email address as in a link.
It is the most deceptive kind of lookalike domain, because careful reading does not help. This article explains which characters get confused, how internationalised domain names and Punycode make the attack possible, what browsers and email clients may show, and how to check a suspicious domain and protect your business.
What is a homoglyph attack?
Homoglyphs are characters with identical or nearly identical shapes. Computers treat them as unrelated: each has its own code point in Unicode, the standard that numbers the characters of the world's writing systems. In a domain name, a single different code point means a different domain, which anyone can register if the extension accepts that character.
The best-known pairs come from the Cyrillic alphabet, which shares several letter shapes with the Latin one:
- Latin a (U+0061) and Cyrillic а (U+0430)
- Latin o (U+006F) and Cyrillic о (U+043E)
- Latin e (U+0065) and Cyrillic е (U+0435)
- Latin p (U+0070) and Cyrillic р (U+0440)
- Latin c (U+0063) and Cyrillic с (U+0441)
Other confusions need no foreign alphabet at all. The digit 0 resembles the letter o, the digit 1 resembles a lowercase l, and in many fonts the pair rn reads as m. These lookalike characters stay within plain ASCII, so the checks for internationalised names described below will not flag them.
Internationalised domain names and Punycode
Domain names were originally limited to unaccented Latin letters, digits and hyphens. Internationalised domain names (IDN) lift that limit, so a name can carry accents or be written in another script. This is legitimate and useful: a French business can use an accented name, a Bulgarian one a Cyrillic name.
The DNS itself still works in ASCII. Each label of the name that contains other characters is therefore converted with an encoding called Punycode, defined in RFC 3492, and prefixed with xn--. That ASCII form is what actually travels through the DNS. Here is acme-properties.com with its first letter replaced by a Cyrillic а:
Displayed: аcme-properties.com
Punycode: xn--cme-properties-utl.comOn screen, the displayed name is identical to the genuine one. Only the Punycode form shows that it is a different domain. This is what security researchers call an IDN homograph attack.
Registries limit the problem without removing it. Each one decides which characters it accepts under its extension, and many refuse a name that mixes two alphabets, such as Latin and Cyrillic, in the same label. Fraudsters work around these rules with names written entirely in Cyrillic letters that all have Latin twins, with accented letters where the extension allows them, or with the ASCII confusions above, which no rule about alphabets can catch.
Why a homoglyph domain looks identical in an email or a link
A font draws the Cyrillic а and the Latin a with the same shape, and in many fonts the two are indistinguishable. Nothing on screen betrays the substitution, whether the name appears in a sender address, a link or an email signature.
Several everyday habits make it worse:
- Email clients often highlight the sender's display name and show the actual address in small print, or only after a click.
- On a phone, addresses are often truncated, and it takes an extra gesture to see where a link leads.
- The visible text of a link can be anything. A link that reads dupont-immo.fr can lead to an entirely different address, homoglyph or not.
- Readers recognise a familiar word as a whole, without checking each letter.
Cyrillic domain spoofing requires no break-in. The fraudster registers the name, sets up a mail server for it like for any other domain, and starts writing to your clients.
What browsers and email clients show
Browser makers know about the problem. Modern browsers apply display rules to internationalised names: when a name mixes alphabets in a suspicious way, or looks designed to imitate a Latin name, they may show the xn-- form in the address bar instead of the Unicode characters. These rules differ between browsers and versions, and they are tuned to avoid false alarms on legitimate names, so some lookalikes still display normally.
Email clients are less consistent. Some display the Unicode form of a sender's domain, others show the Punycode form in certain cases, and few readers ever look at the raw address anyway.
Treat these mechanisms as a bonus, not as protection. They do nothing against ASCII confusions such as 0 for o, and you cannot know which software your clients use.
How to check a suspicious domain
When an email or a link looks right but the context is unusual (new bank details, an urgent payment, a document to sign), check the domain before acting:
- Do not click the link. Copy the address or the sender's domain instead.
- Paste it into a plain-text editor. Switching to a monospaced font can make a substituted character look slightly different.
- Search for each letter. Use the editor's Find function to look for the Latin letters of the expected name: a Cyrillic letter will not match, even if it looks identical.
- Look at the Punycode form. If converting the name gives a label starting with xn--, it contains non-ASCII characters and is not the domain you know.
- Compare with a source you trust, such as your address book, a previous invoice or the contract. Type the known domain yourself rather than copying it from the suspicious message.
For your own domain, the question is the reverse: which homoglyph variants of your name already exist? Spamr's free scan generates them, Cyrillic substitutions included, along with typos and other variants, and checks only public DNS and registration data, never the lookalike sites. Anyone sees the counts and the three most dangerous lookalikes. The full list is reserved for whoever proves they manage the domain.
How to protect your business against homoglyph attacks
No single measure covers every case. Four layers work together.
Register the most obvious variants
Registering a few names closest to yours defensively (your name under the other main extensions, the most obvious substitution such as a zero for an o) takes them out of fraudsters' hands. You cannot register every variant, and some internationalised variants may not be available under your extension, so treat this as a complement.
Monitor new lookalikes
A homoglyph domain can be registered any day. Monitoring compares the registered variants of your name over time and alerts you when one appears or gains a mail server. Spamr's monitoring plans rescan your domain daily, send email alerts and offer assisted takedown requests for the most dangerous lookalikes.
Publish DMARC on your own domain
DMARC does not stop homoglyph domains: they are different domains with their own records. It does stop fraudsters from sending email under your exact domain, which pushes them towards lookalikes, the kind you can detect. The protocol is specified in RFC 9989, and our step-by-step DMARC p=reject guide shows how to reach an enforcing policy safely.
Train staff to call back
The barrier that works whatever the domain is a procedure: any request to change bank details, from a supplier or a client, is confirmed by phone on a number you already had, never one given in the email. The same rule applies to unusual payment requests from a manager. Our guide on payment diversion fraud details this procedure, and the UK's NCSC publishes free phishing guidance for staff.
Key takeaways
- A homoglyph attack swaps characters for identical-looking ones, such as a Cyrillic а for a Latin a, or 0 for o.
- Internationalised names travel through the DNS in Punycode, prefixed with xn--. That form reveals non-ASCII characters.
- Browsers and email clients may show the xn-- form in some cases, but you cannot rely on it.
- To check a domain, paste it into a plain-text editor and search for each letter. Never click.
- Combine a few defensive registrations, monitoring, DMARC on your own domain and a call-back rule for bank details.
Frequently asked questions
What is the difference between a homoglyph attack and typosquatting?
Typosquatting relies on typing or reading mistakes: a missing letter, swapped letters, another extension. A homoglyph attack uses characters that look identical, so even a careful reader sees the expected name. Both produce lookalike domains, covered in our guide to detecting lookalike domains.
What does xn-- mean at the start of a domain name?
It marks a label encoded in Punycode, the ASCII form of an internationalised domain name. The displayed name contains characters other than unaccented Latin letters, digits and hyphens. That is normal for a name in another script, and suspicious when the displayed name looks like a familiar Latin one.
Can anyone register a domain with Cyrillic letters?
Yes, under extensions whose registry accepts Cyrillic characters. Each registry sets its own rules, and many refuse names that mix Latin and Cyrillic in the same label. Names written entirely in Cyrillic letters that resemble Latin ones remain possible under some extensions.
Does DMARC protect against homoglyph domains?
No. DMARC protects your exact domain against spoofing, and a homoglyph domain is a different domain with its own DNS records. DMARC is still worth deploying, as our DMARC p=reject guide explains. Against lookalikes, combine monitoring with a call-back rule for any change of bank details.