Warning: The following links are phishing links, please do not sign in to them.

Today, a friend of mine came across the link hxxp://steạmcommunlty(dot)com/tradeoffer/new/. It's a phishing link, but I have no idea how it works. Notice the a in steam is a special character? When you go to that link and copy and paste it, it somehow converts to xn--stemcommunlty-kf2g(dot)com

How is it doing that? Is it something to do with the converting into something else making it a completely different URL?

  • Compare аррӏе.com with apple.com. It's just unicode which has characters that look identical to regular ASCII. – forest Dec 12 '17 at 4:51

Browser is doing this to follow the standard regarding hostnames containing non-ASCII characters:

Non-ASCII domain names ("IDNA") rely on a special transfer encoding ("Punycode") to allow non-ASCII domain values inside the ASCII-only DNS nameserver hierarchy. Punycode encodes a domain name such as "faß.de" using special markup that looks like so: "xn--fa-hia.de"

This is done for all domains containing such characters, and has nothing to do with domain being phishing.

PS. Your "steạmcommunlty" domain name also uses lowercase L instead of I in the word "community".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.