Can a look-alike domain use letters from another alphabet?

How do international domain names work?

homograph exploits: threat actors use characters from different alphabets (for example, Cyrillic or Greek) that look almost identical to standard Latin letters but are coded differently

Domain names were first limited to Latin letters, digits and the hyphen. Internationalized domain names allow other scripts by encoding them.

Punycode, defined in RFC 3492 in March 2003, turns a Unicode name into an ASCII string and back again without loss. The ASCII form begins with the four characters xn-- followed by the encoded name.

Why is this a look-alike risk?

To better protect against these attacks, browsers display some domains in punycode (looks like xn--... ) instead of the original IDN, according to their own IDN policies.

A Cyrillic a and a Latin a can look the same on screen while being different characters, so a whole name can match yours by eye and still belong to someone else.

To protect against these attacks, browsers show some domains in that xn-- form instead of the original characters, each by its own policy.

How can I spot one?

It uniquely and reversibly transforms a Unicode string into an ASCII string.

If an address or link shows xn-- where you expected your own name, it is not your domain.

Copy the address into a plain text editor or a lookup tool. The encoded form shows what the name really is.

What can I do about international look-alikes?

This representation includes a four-character prefix ( xn-- ) and then the unicode translated to ASCII Compatible Encoding (ACE).

1. Treat any link or sender address containing xn-- with care unless you know why it is there.
2. Check whether versions of your name with accented or foreign letters are registered.
3. Register the closest version yourself if clients may type it, and redirect it to your real site.