Phishing attack uses Unicode characters in domains to clone known safe sites
For reference, the example is using:<p><pre><code>    U+0435 CYRILLIC SMALL LETTER IE
    U+0440 CYRILLIC SMALL LETTER ER
    U+0456 CYRILLIC SMALL LETTER BYELORUSSIAN-UKRAINIAN I
    U+0441 CYRILLIC SMALL LETTER ES
</code></pre>
...which are basically <i>indistinguishable</i> from the corresponding ASCII (65 70 69 63) in most if not all fonts.<p>I don't see this as being an easy or even solvable problem in general --- after all, a Russian IDN registrar could rightly argue that it should be valid to use all Cyrillic characters in IDNs; but at least for those of us who are content with English-only domain names, we can just disable IDN.<p>I suppose one solution would be, when IDN is detected, to show both the Unicode and Punycoded versions:<p>[www.xn--e1awd7f.com]<a href="https://www.epic.com/" rel="nofollow">https://www.epic.com/</a><p>One could also argue that this is also a usability feature, for easy copying of IDNs by those who otherwise cannot write them.