How do I check an address that looks identical to the real one?

Don't rely on reading it: that's precisely what the attack gets around. Rely on your password manager's behavior instead, or don't use the link at all and go through a bookmark.

Does this attack also work on a phone?

Yes, and the risk is greater there: mobile browsers display the address in truncated form, leaving even less visible material to spot an anomaly.

What does an address starting with xn-- mean?

It's the encoded form of a domain containing non-Latin characters. It isn't fraudulent by itself, but seeing this form where you expected an ordinary name is reason enough not to log in.

Homoglyph attack

In plain terms

A web address that reads exactly like the right one, because a letter has been swapped for a character from another alphabet that looks identical to it. Re-reading it doesn't help: the eye can't see the difference.

Definition

A homoglyph attack uses characters from different alphabets that are visually identical to Latin characters to compose a web address that looks genuine to the eye, while actually pointing to an entirely different domain.

How it works

Several writing systems share identical or near-identical letter shapes: certain Cyrillic or Greek letters are indistinguishable from their Latin equivalents to the naked eye. By substituting just one of these letters in a domain name, the attacker gets an address that displays like the original but points to their own server. Unlike typosquatting, there's no typo to spot here: careful reading isn't enough, because the characters are genuinely different for the machine while being identical to the eye. Browsers defend against this by displaying such domains in their encoded technical form when they mix alphabets.

Warning signs

Address displayed in a technical form starting with "xn--", a sign of an internationalized domain
Browser warning flagging a domain mixing several alphabets
Link received by message whose address nonetheless looks perfectly correct
Login page reached via a link rather than a bookmark
Password manager not offering to fill in the form

How to verify

The most reliable signal is your password manager's behavior: it associates your credentials with the real domain, not its appearance. If it offers nothing on a site you normally use, assume the domain isn't the expected one. Otherwise, reach the service through a saved bookmark.

What to do

Don't enter any credentials. Close the tab and access the service through a path you control.

If it already happened

Change the password of the affected service from a session opened by your own means, enable two-factor authentication, and check the account's login history.

Frequently asked questions

How do I check an address that looks identical to the real one?: Don't rely on reading it: that's precisely what the attack gets around. Rely on your password manager's behavior instead, or don't use the link at all and go through a bookmark.
Does this attack also work on a phone?: Yes, and the risk is greater there: mobile browsers display the address in truncated form, leaving even less visible material to spot an anomaly.
What does an address starting with xn-- mean?: It's the encoded form of a domain containing non-Latin characters. It isn't fraudulent by itself, but seeing this form where you expected an ordinary name is reason enough not to log in.

Official sources

This article is part of the Website and browser attacks family. Last updated: 2026-08-31.