Unicode characters have also introduced a significant security risk known as homograph attacks, or homoglyph attacks. These attacks aim to create fake websites by using visually similar letters from different alphabets. For example, because the Cyrillic letter “а” and the Latin letter “a” look almost identical, malicious actors can create domain names such as “раураl.com”, a fake version of “paypal.com” written with Cyrillic characters. This opens the door to phishing attacks and can be used to steal users’ sensitive information.
Homograph Attacks and Threats
Homograph attacks are a form of deception that exploits visual similarities between Unicode characters. These attacks present serious risks, particularly in the following areas:
Phishing Attacks: Users may be redirected to a fake banking or e-commerce website and tricked into sharing passwords or credit card information.
Malware Distribution: Fake websites may contain links that distribute malicious software.
Typosquatting: Users may be deceived through fraudulent websites with domain names that resemble those of major brands.
Examples:
Legitimate: amazon.com
Fake, using Cyrillic characters: аmazon.com
Legitimate: google.com
Fake, using a subtle variation: ɢoogle.com, created with the Unicode character “ɢ”
These attacks are particularly dangerous for mobile users because visual differences can be much harder to notice on smaller screens and at lower resolutions.
Security Measures Used by Browsers
Google Chrome and other modern browsers use various security measures to prevent homograph attacks:
Punycode Conversion: Suspicious Unicode domain names may be displayed in ASCII format using Punycode. For example, instead of müzik.com, the browser may display a format such as xn--mzik-7na.com.
Mixed-Script Detection: If a domain name contains characters from different alphabets, such as a combination of Latin and Cyrillic characters, the browser may identify it as a potential attack and display a warning.
Google Safe Browsing: Chrome and other major browsers use Safe Browsing systems to detect phishing websites and block suspicious pages.
Use of HTTPS: Legitimate websites are generally protected with HTTPS. Users may receive a warning when a website does not use an encrypted connection.
Security Recommendations for Users
There are several important points users should consider to protect themselves against IDN-related risks and homograph attacks:
✅ Examine domain names carefully: Check whether the domain name of the website you are visiting is correct. Be especially careful when using banking and shopping websites.
✅ Check the HTTPS connection: Secure websites are generally protected with HTTPS. Be cautious if a website opens over HTTP.
✅ Be cautious of suspicious emails: Phishing attacks are often carried out through fraudulent emails. Before clicking a link in an email, hover over it to check the actual destination address.
✅ Keep your browser’s security settings up to date: Browsers such as Chrome, Firefox, and Edge provide protection against homograph attacks. Use strong security settings and do not neglect software updates.
✅ Use security tools: Antivirus software and browser security extensions may detect suspicious domain names and warn you before you access them.
Google: Using Non-English URLs for Non-English Websites Is Not a Problem
Google Senior Webmaster Trends Analyst John Mueller stated in a published video that using non-English URLs for non-English websites is not a problem and that Google can crawl, index, and rank them.
This also applies to non-Latin characters used in URLs. John Mueller said, “As long as the URLs are valid and unique, that is fine.” He added, “In summary, yes, non-English words and URLs are fine, and we recommend using them for non-English websites.”
Conclusion
Internationalised Domain Names, or IDNs, provide a major advantage for global internet accessibility, but they also introduce cybersecurity threats such as homograph attacks. Although modern browsers have implemented strong measures against these threats, users must still remain cautious. In summary, if a domain name appears suspicious, verify its authenticity, apply appropriate security precautions, and think twice before sharing personal information. Staying safe online begins with being an informed user.
