Pharming & Homograph Attacks
Attackers manipulate URLs to trick even careful users. Techniques include typosquatting, IDN homograph attacks using lookalike Unicode characters, and subdomain tricks β all designed to fool the eye.
π£ Phase 1 β The Bait
Look at each URL in your address bar. Can you spot which ones are fake? They may look identical at first glance.
Can You Spot the Fake? β 8 URL Challenge
Study each browser address bar carefully. Which are legitimate and which are phishing URLs?
π Phase 2 β The Reveal
Here are all 8 URLs decoded. 5 were fakes. Here's exactly how each attack technique works.
π¬ Homograph Attack Deep Dive
The IDN (Internationalised Domain Name) homograph attack uses Unicode characters that look pixel-identical to Latin letters in most fonts. Color alone can't show the difference here since there isn't a visual one β hover any underlined character below for its real identity.
| Fake Char | Unicode | Looks Like | Real Char | Script |
|---|---|---|---|---|
| Π° | U+0430 | a | a | Cyrillic |
| ΠΎ | U+043E | o | o | Cyrillic |
| Π΅ | U+0435 | e | e | Cyrillic |
| Ρ | U+0440 | p | p | Cyrillic |
| Δ± | U+0131 | i | i | Turkish |
paypal.com.login-verify.net/secure β the human eye sees "paypal.com" first and stops reading. But the actual domain (the part immediately before the first single slash) is login-verify.net. PayPal.com is just a subdomain of the attacker's site.π‘οΈ Phase 3 β Defending Against Pharming & Homograph Attacks
- Identify the actual domain: read the URL right-to-left from the first single slash. The part just before
/is the real domain. - Bookmark important sites and access them only via bookmarks β never by clicking links.
- Use a browser that shows Punycode for IDN domains (Chrome shows
xn--prefix for suspicious homograph domains). - Enable DNSSEC validation on your network to prevent DNS poisoning (pharming via DNS).
- Use a trusted DNS resolver (Cloudflare's 1.1.1.1, Google's 8.8.8.8) with built-in malware filtering.
- Check domain registration date with WHOIS β phishing domains are typically days or weeks old.
- Use browser extensions like uBlock Origin or Netcraft to flag known phishing domains automatically.