How to Detect & Prevent Homograph Attacks (IDN Character Spoofing)

In modern web security, one of the most stealthy phishing vectors is the IDN Homograph Attack. By swapping standard ASCII characters with visually identical glyphs from foreign alphabets—such as Cyrillic, Greek, or Latin extended—attackers construct URLs that appear 100% indistinguishable to the human eye from legitimate banking or SaaS portals.

1. What is an IDN Homograph Attack?

Internationalized Domain Names (IDNs) were introduced to allow non-English speaking populations to register domain names in their native scripts (e.g., Cyrillic, Arabic, Chinese, Devanagari). To preserve backward compatibility with the legacy Domain Name System (DNS), ICANN adopted the Punycode encoding scheme (RFC 3492).

Punycode translates Unicode strings into ASCII-compatible strings prefixed with xn--. For instance:

Original Unicode Domain : google.com (using Cyrillic 'о' U+043E)
Punycode Output         : xn--gogle-80a.com

When a victim receives a link like https://gооgle.com in an email or chat message, their web browser parses the Cyrillic characters and displays the rendered text as "google.com". However, the browser actually connects to xn--gogle-80a.com—a malicious server controlled by an attacker designed to harvest credentials.

2. Commonly Exploited Unicode Glyphs

The table below illustrates high-risk homograph character substitutions frequently observed in credential harvesting campaigns:

3. Technical Detection Methodology

To protect users effectively, high-speed edge scanners like IncogSay analyze incoming URLs using mixed-script inspection algorithms before rendering or following redirects.

Step A: Punycode Prefix Detection

Any hostname component containing the prefix xn-- is automatically flagged for IDN inspection. If the domain contains non-ASCII characters directly, the engine converts it using standard RFC 3492 transformation rules.

Step B: Mixed-Script Entropy Analysis

A legitimate domain rarely mixes scripts (e.g., Latin script mixed with Cyrillic script within the same label). If a domain label contains both Latin characters ([a-zA-Z]) and Cyrillic characters ([\u0400-\u04FF]), it is assigned a high risk score for deliberate homograph obfuscation.

// Example JavaScript detection logic for mixed scripts
function detectMixedScriptHomograph(hostname) {
  const labels = hostname.split('.');
  const cyrillicRegex = /[\u0400-\u04FF]/;
  const latinRegex = /[a-zA-Z]/;

  for (const label of labels) {
    if (cyrillicRegex.test(label) && latinRegex.test(label)) {
      return {
        isHomograph: true,
        risk: 'CRITICAL',
        reason: 'Mixed Cyrillic and Latin characters detected in single label'
      };
    }
  }
  return { isHomograph: false };
}

4. Defense & Mitigation Strategies for Organizations

• Browser IDN Safety Display: Modern browsers like Chrome, Firefox, and Safari show the raw xn-- Punycode string in the address bar if a domain mixes scripts or belongs to an untrusted TLD.
• Proactive Defensive Domain Registration: Enterprise brand security teams proactively register common homograph variants of their flagship domains (e.g. registering common Cyrillic variants) and point them to defensive 301 redirects.
• Real-Time Edge URL Scanning: Implement automated edge scanning tools that inspect incoming links in emails and security gateways prior to execution.

5. How IncogSay Audits Homograph Threats

IncogSay's zero-trust scanner runs an in-memory Punycode decoder and visual character matrix at Cloudflare Edge locations worldwide. When you audit a link using our URL Scanner or Safe Link Checker, our engine instantly extracts hidden Punycode labels, measures character entropy, and warns you before you click.