In this case the domain name is legitimate; the homoglyph is in the query string instead. In fact, you can copy "tianаnmen square massacre" from this HN commen

In this case the domain name is legitimate; the homoglyph is in the query string instead. In fact, you can copy "tianаnmen square massacre" from this HN comment and paste it into any search engine to get the same result. Recent browsers do protect against character spoofing in IDNs, and provide various UI features to make it easy to authenticate the domain name and identity. The same protection isn't applied to the rest of the URI, however. Mozilla's Jesse Ruderman gave an interesting talk at the SOUPS conference on a similar class of attacks, some of which do not even require special characters - they are like SQL injection for the English language: http://www.squarefree.com/2010/07/14/untrusted-text-in-security-dialogs/ http://www.squarefree.com/2010/07/14/untrusted-text-in-secur...