Short answer
A homoglyph domain replaces one or more letters with characters from another script that look the same, such as a Cyrillic "а" for a Latin "a". In DNS it is stored as punycode starting with xn--. Chrome shows the xn-- form for many risky mixes, but not every case, so wallets, chat apps and monitoring still need to catch them.
Who this is for: Crypto teams and moderators checking links that look exactly right.
How it works
Domain names were designed for Latin letters, digits and hyphens. Internationalized domain names (IDNs) let people register names in other scripts. In DNS they are stored in an ASCII form called punycode, and every such label begins with the prefix xn-- (RFC 5890).
A homograph attack uses this to build a domain that renders like a familiar Latin one. Chromium's documentation gives the example of ebаy.com with a Cyrillic "а": on screen it looks like eBay, in DNS it is a completely different, unrelated domain.
Common confusables
| Latin | Look-alike | Script |
|---|---|---|
| a | а (U+0430) | Cyrillic |
| e | е (U+0435) | Cyrillic |
| o | о (U+043E), ο (U+03BF) | Cyrillic, Greek |
| p | р (U+0440) | Cyrillic |
| i | ı (U+0131, dotless i) | Latin extended |
Unicode Technical Standard #39 maps each character to a "skeleton", so two strings that look the same reduce to the same skeleton. Comparing skeletons is how software spots a homoglyph of a known name.
What browsers do
Chrome shows the raw xn-- form instead of Unicode in risky cases: when Latin, Cyrillic or Greek letters are mixed in one label, when a label is made of whole-script confusables, or when its skeleton matches a top domain. That protects many users, but not everyone:
- a name that is not on the browser's list of top domains can still render in Unicode;
- chat apps, wallets and social posts show the Unicode form in previews;
- some homoglyphs stay inside one script and pass the mixing rules.
How to detect them
- Convert a suspicious domain to punycode. If any label starts with
xn--, it contains non-ASCII characters. - Generate homoglyph variants of your own domain. Our lookalike checker includes them and shows which are registered.
- Watch Certificate Transparency logs for new certificates whose names reduce to your name's skeleton.
- Tell users to type your domain or use a bookmark for anything involving a wallet.
Sources
- RFC 5890: IDNA definitions
- RFC 3492: Punycode
- Unicode UTS #39: security mechanisms
- Chromium: IDN display policy
Frequently asked questions
How do I see the real form of a suspicious domain?
Paste it into a punycode converter or look at the address bar after the page loads. If the domain starts with xn--, it contains non-ASCII characters.
Are all xn-- domains malicious?
No. Internationalized domains are legitimate for many languages. They are a problem when they imitate a Latin brand name.