You may have been exposed to internationalized domain names (IDNs) without realizing it. While they typically do not affect your browsing activity, IDNs may give attackers an opportunity to redirect you to a malicious web page.

What are internationalized domain names?
To decrease the amount of confusion surrounding different languages, there is a standard for domain names within web browsers. Domain names are included in the URL (or web address) of web site. This standard is based on the Roman alphabet (which is used by the English language), and computers convert the various letters into numerical equivalents. This code is known as ASCII (American Standard Code for Information Interchange). However, other languages include characters that do not translate into this code, which is why internationalized domain names were introduced.

To compensate for languages that incorporate special characters (such as Spanish, French or German) or rely completely on character representation (such as Asian or Arabic languages), a new system had to be developed. In this new system, the base URL (which is usually the address for the home page) is dissected and converted into a format that is compatible with ASCII. The resulting URL (which contains the string “xn--” as well as a combination of letters and numbers) will appear in your browser’s status bar. In newer versions of many browsers, it will also appear in the address bar.
What are some security concerns?

Attackers may be able to take advantage of internationalized domain names to initiate phishing attacks (see Avoiding Social Engineering and Phishing Attacks for more information). Because there are certain characters that may appear to be the same but have different ASCII codes (for example, the Cyrillic “a” and the Latin “a”), an attacker may be able to “spoof” a web page URL. Instead of going to a legitimate site, you may be directed to a malicious site, which could look identical to the real one. If you submit personal or financial information while on the malicious site, the attacker could collect that information and then use and/or sell it.
How can you protect yourself?

• Type a URL instead of following a link - Typing a URL into a browser rather than clicking a link within a web page or email message will minimize your risk. By doing this, you are more likely to visit the legitimate site rather than a malicious site that substitutes similar-looking characters.
  
• Keep your browser up to date - Older versions of browsers made it easier for attackers to spoof URLs, but most newer browsers incorporate certain protections. Instead of displaying the URL that you “think” you are visiting, most browsers now display the converted URL with the “xn--” string.
• Check your browser’s status bar - If you move your mouse over a link on a web page, the status bar of your browser will usually display the URL that the link references. If you see a URL that has an unexpected domain name (such as one with the “xn--” string mentioned above), you have likely encountered an internationalized domain name. If you were not expecting an internationalized domain name or know that the legitimate site should not need one, you may want to reconsider visiting the site. Browsers such as Mozilla and Firefox include an option in their security settings about whether to allow the status bar text to be modified. To prevent attackers from taking advantage of JavaScript to make it appear that you are on a legitimate site, you may want to make sure this option is not enabled.

• If an “opportunity” appears too good to be true, it probably is.
• Do not invest in anything unless you understand the deal. Con artists rely on complex transactions and faulty logic to “explain” fraudulent investment schemes.
• Do not invest or attempt to “purchase” a “Letter of Credit.” Such investments simply do not exist.
• Be wary of any investment that offers the promise of extremely high yields.
• Independently verify the terms of any investment that you intend to make, including the parties involved and the nature of the investment.

1. If the offer of an “opportunity” appears too good to be true, it probably is. Follow common business practice. For example, legitimate business is rarely conducted in cash on a street corner.
2. Know who you are dealing with. If you have not heard of a person or company that you intend to do business with, learn more about them. Depending on the amount of money that you intend to spend, you may want to visit the business location, check with the Better Business Bureau, or consult with your bank, an attorney, or the police.
3. Make sure you fully understand any business agreement that you enter into. If the terms are complex, have them reviewed by a competent attorney.
4. Be wary of businesses that operate out of post office boxes or mail drops and do not have a street address, or of dealing with persons who do not have a direct telephone line, who are never “in” when you call, but always return your call later.
5. Be wary of business deals that require you to sign nondisclosure or noncircumvention agreements that are designed to prevent you from independently verifying the bona fides of the people with whom you intend to do business. Con artists often use noncircumvention agreements to threaten their victims with civil suit if they report their losses to law enforcement.