Punycode and homographs: when a fake domain looks like the real one

Look at these two addresses: paypal.com and pаypal.com. Identical? To our eyes, yes. To a computer, not at all: in the second one, the second “а” is a letter from the Cyrillic alphabet, not a Latin “a”. They are two different domains, which can belong to two different people. This is the principle of homograph attacks, and to understand them, we need a short detour through the way the Internet writes names.

Unicode, ASCII and Punycode: three words, one simple idea

Originally, domain names only accepted a tiny alphabet called ASCII: the letters a to z without accents, digits and the hyphen. No “é”, no “ü”, let alone Arabic, Chinese or Cyrillic.

Yet the world writes in dozens of alphabets. Unicode is the big catalogue that gives a number to every character of every script: the Latin “a” is number U+0061, the Cyrillic “а” is number U+0430. Same shape, different numbers.

To allow domain names in every language without changing the whole network, a translator was invented: Punycode. It turns a name written in Unicode into a name that only uses the ASCII alphabet, and marks it with the prefix xn--. The browser displays the nice version; the network only sees the translated one.

How an “xn--” domain works

Let's take a perfectly honest example: the French domain société.fr (“company”). The network cannot read “é”. Punycode sets the special letters aside, keeps the ordinary ones, and adds a small code at the end that says where to put the accents back:

société.fr   →   xn--socit-esab.fr

We find “socit” (the ordinary letters), then “esab”, the code that tells which characters to insert and where. The xn-- prefix simply warns: “careful, this name has been translated.” Millions of legitimate names work this way, in German, Arabic, Chinese, Russian. An xn-- is therefore not suspicious in itself. It becomes suspicious when it imitates a well-known brand.

Homoglyph attacks: the false twins

A homoglyph is a character that looks confusingly like another. And Unicode contains many of them: the Cyrillic “а”, “е”, “о”, “р” and “с” are perfect look-alikes of our a, e, o, p and c. The Greek “ο” imitates the “o”.

The scammer buys a domain in which one or more letters are replaced by their look-alike. In 2017, a researcher demonstrated this spectacularly: he registered xn--80ak6aa92e.com, which is written аррӏе.com using entirely Cyrillic letters, and several major browsers simply displayed “apple.com” in the address bar. Browsers have since fixed that case.

Why the address can look legitimate

Modern browsers apply cautious rules: when a name mixes alphabets suspiciously, or looks too much like a known domain, they display the xn-- form instead of the nice version. It is good protection, but it has limits:

• outside the address bar, these rules don't always apply: in the text of an email, a text message, a PDF or an instant messaging app, the “disguised” version is displayed as is;
• the rules vary from one browser, version and app to another;
• a hurried glance, on a small screen, cannot tell two identical characters apart. And Unicode isn't always needed: rn mimics m, 1 mimics l, as the guide Phishing: how scammers get their emails through explains.

And as with any trap domain, the site can have a valid HTTPS certificate and a nice padlock: they prove that the connection is encrypted, not that the site is honest.

How to really check a domain

When in doubt, we don't trust what we see, we make the real name speak:

1. We don't click. We copy the link (right-click, “copy link address”).
2. We paste it into a Punycode converter (there are many free ones online): if an xn-- form appears for a name that is supposed to be perfectly ordinary, it is a trap.
3. We isolate the domain: the part just before the first “/”. The guide Quishing: when phishing hides behind a QR code explains this reading in detail.
4. We take a safe route: a bookmark we saved ourselves, or the official app. A password manager helps too: it is not fooled by a look-alike and offers nothing on a fake domain.

Baitback does part of this work automatically: when we paste an email into it, it flags links in Punycode (xn-- form) and look-alike domains of the brands it knows, including by homoglyph, and also checks the final destination after redirects.

Identifying the registrar and the host

To make the domain disappear, we look for who sold it and who hosts it. We always use the xn-- form in lookup tools: it is the real name, the one registries know.

• An RDAP or WHOIS lookup on the domain gives the registrar, its abuse address and the domain's creation date. A brand look-alike created last week leaves little room for doubt.
• The site's IP address reveals its host, or the CDN placed in front of it, which also accepts reports and forwards them.

The registrar is the most effective player here: a domain imitating a brand through homoglyphs is a very clear case of abuse, and suspending the name cuts off the site, the emails and every associated page in one go.

Reporting the domain

A good report fits in a few lines: the Unicode form and the xn-- form of the domain, the impersonated brand, the full address of the page, a screenshot, the date and time. We send it to the registrar and to the host or CDN, and we warn the impersonated brand.

If the domain arrived by email, we start with Baitback: we paste the message's full source, the tool finds the sending server and its host, picks out the suspicious links and prepares the reports. It also lists the browser platforms (Google Safe Browsing, Microsoft, Netcraft…), which can display a red warning to every visitor within a few hours.