0

Warning: The following links are phishing links, please do not sign in to them.

Today, a friend of mine came across the link hxxp://steạmcommunlty(dot)com/tradeoffer/new/. It's a phishing link, but I have no idea how it works. Notice the a in steam is a special character? When you go to that link and copy and paste it, it somehow converts to xn--stemcommunlty-kf2g(dot)com

How is it doing that? Is it something to do with the ạ converting into something else making it a completely different URL?

Improve this question
1
  • Compare аррӏе.com with apple.com. It's just unicode which has characters that look identical to regular ASCII.
    – forest
    Commented Dec 12, 2017 at 4:51

1 Answer 1

Reset to default
3

Browser is doing this to follow the standard regarding hostnames containing non-ASCII characters:

Non-ASCII domain names ("IDNA") rely on a special transfer encoding ("Punycode") to allow non-ASCII domain values inside the ASCII-only DNS nameserver hierarchy. Punycode encodes a domain name such as "faß.de" using special markup that looks like so: "xn--fa-hia.de"

This is done for all domains containing such characters, and has nothing to do with domain being phishing.

PS. Your "steạmcommunlty" domain name also uses lowercase L instead of I in the word "community".

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .