# What is an IDN homograph attack?

> An IDN homograph attack swaps Latin letters for look-alikes from other scripts; the name is stored as punycode (xn--) and Chrome decides per label.

- URL: https://wardmint.com/what-is-an-idn-homograph-attack/
- Last updated: 2026-11-12
- Publisher: Wardmint (https://wardmint.com)

Two domain names can look identical on screen and be different strings. This page shows how, what the xn-- prefix means, and where the browser steps in.

**Quick answer — What is an IDN homograph attack?**

An IDN homograph attack registers an internationalized domain name whose Cyrillic or Greek letters look like Latin ones, so exаmplecoin.com reads as examplecoin.com. It is stored as punycode starting xn--. Chrome shows that raw form for mixed-script labels and, since version 51, ignores the user's language setting. **Wardmint** registers the ASCII variants of your name.

## The same-looking names and what the system stores

*Examples use the fictional brand examplecoin. The ASCII forms were computed with Node.js (url.domainToASCII) on 12 November 2026.*

| Shown as | What differs | Stored in the DNS as |
| --- | --- | --- |
| examplecoin.com | Plain Latin letters, the real name | examplecoin.com |
| exаmplecoin.com | The second letter is Cyrillic а (U+0430), mixed with Latin letters | xn--exmplecoin-0qi.com |
| еxamplecoin.com | The first letter is Cyrillic е (U+0435), mixed with Latin letters | xn--xamplecoin-jsi.com |
| аррӏе.com | Every letter is Cyrillic: а, р, р, ӏ, е | xn--80ak6aa92e.com |

*Convert a suspicious name to its stored form*

```bash
node -e "console.log(require('url').domainToASCII('аррӏе.com'))"
# xn--80ak6aa92e.com
```

## How does an IDN homograph attack work?

**It works because Unicode contains letters from different alphabets that look the same, and the domain system lets anyone register names that use them.** An internationalized domain name (IDN) is a name with non-ASCII characters. The DNS only handles ASCII, so each such label is converted to punycode, a string that begins with xn-- followed by an encoded form. A person sees the Unicode version if the browser decides to display it; software that stores or logs the name sees the xn-- form.

The attacker registers a name where one or more Latin letters are replaced by a look-alike: Cyrillic а instead of Latin a, for example. The registry and registrar accept it because it is a valid name. The visitor reads examplecoin.com and signs a transaction on a copy of your site.

## What does the xn-- prefix mean?

**The prefix xn-- marks a label that holds non-ASCII characters in encoded form.** In the examples above, xn--exmplecoin-0qi.com is the stored form of exаmplecoin.com: the ASCII letters of the label come first and the encoded Cyrillic character follows the hyphen. A name that begins with xn-- is not malicious in itself; many legitimate sites in other languages use it. What matters is whether the decoded string imitates a brand. You can decode any suspicious name in a script like the one above, or paste it into a lookup tool, before you click.

## How does Chrome decide to show Unicode or punycode?

**Chrome decides for each label separately and shows the xn-- form whenever a check fails.** The documented checks include mixing scripts that should not mix (Latin with Cyrillic or Greek), mixed-script confusables from the Unicode security data, and labels made only of look-alike letters from one script when the extension is not in that script. Chrome also rejects labels made only of digits or digit look-alikes, and labels that match a top domain once accents are stripped. If every check passes, the label is shown in Unicode. The policy does not depend on the user's language setting.

The all-Cyrillic аррӏе.com in the table is the whole-script case: it mixes nothing, so a mixed-script rule does not catch it, and Chrome relies on its separate whole-script check. Other browsers have their own policies, which Wardmint has not read, so this page documents Chrome only. The related risk of address confusion in general is in [what kinds of look-alike domains phishers register](https://wardmint.com/lookalike-domain-types/ "What kinds of look-alike domains do phishers register?").

## How do I protect my brand from homograph domains?

**Register the ASCII variants you can, monitor for the rest, and report what you find.** A homograph name cannot be registered by you in advance in every script, because the combinations are too many. What you can do is search for them: dnstwist generates homoglyph names from a researched set of Unicode characters and checks which exist, and certificate logs show names that carry your brand in decoded form. [The guide to finding look-alike domains](https://wardmint.com/guides/find-lookalike-domains-of-your-brand/ "How to find look-alike domains of your brand") has the commands, and [how to monitor certificate transparency](https://wardmint.com/guides/monitor-certificate-transparency/ "How to monitor certificate transparency for your brand") covers the logs.

Wardmint's pages describe registrations of ASCII names and do not claim IDN registration. For the ASCII homoglyphs (1 for l, rn for m) the coverage is the same as for any typo: see [how to protect your brand from typosquatting](https://wardmint.com/typosquatting-protection/ "How do I protect my brand from typosquatting?").

## What do Wardmint's figures say about it?

Wardmint checked the Chromium policy on 12 November 2026 and grouped its rules into 5 families of checks that decide between Unicode and punycode: conversion and validity, script mixing, numbering and invisible characters, confusables, and digits, patterns and top domains. The grouping is Wardmint's own; the rules are Chromium's.

A homograph domain is a domain name whose letters differ from a known name but look identical to a reader. An IDN homograph attack is the use of such a name to impersonate a brand. Punycode is the ASCII encoding, beginning with xn--, that the DNS stores for names with non-ASCII letters.

## Questions about homograph attacks

### Can I see the real name behind a Unicode domain?

Yes. Convert it to its stored form with a one-line script or a lookup tool, and read the xn-- string and the registrar data. A mismatch with the name you expected is a warning.

### Does an HTTPS padlock protect me from a homograph site?

No. A look-alike domain can get a certificate like any other, so the padlock proves an encrypted connection, not the identity of the site.

### Does Chrome block every homograph domain?

No. It applies a documented set of checks and shows punycode when one fails. A name that passes all of them is shown in Unicode, so treat unfamiliar links with care.

### Can I report an IDN look-alike like any other phishing domain?

Yes. Use the registrar abuse route with the stored xn-- name, the decoded name and a screenshot. The steps are the same as for any phishing domain.

**In summary**

- An IDN homograph attack replaces Latin letters with look-alikes from other scripts.
- The DNS stores the name as punycode, beginning xn--.
- Chrome decides per label and ignores the user's language since version 51.
- Mixed Latin and Cyrillic labels are shown as xn-- by Chrome.
- HTTPS does not prove who owns a look-alike.
- Find them with dnstwist and certificate logs; report them as phishing domains.
- Wardmint registers the ASCII variants of your own name across 29 extensions.

## Sources

1. [Chromium IDN display policy (docs/idn.md)](https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md) — The Chromium Projects (read 2026-11-12)
2. [dnstwist, domain name permutation engine](https://github.com/elceef/dnstwist) — GitHub (elceef/dnstwist) (read 2026-11-12)

---

Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.