Welcome to ցօ.com, I'm Adam Sculthorpe a cyber security professional with more than 20 years experience in developing security intelligence solutions for government, military, investment banks and leading corporations.

This site is a demonstration of how different browsers handle Internationalized Domain Names (IDN).  Copy the URL in the address bar of your browser and paste it into Chrome, Firefox, Edge and other browsers.

You'll notice the name gets handled in different ways by different browsers.

Some browsers will give a warning and display the domain as xn--vbbi.com, some will display xn--vbbi.com without a warning and some display it's legitimate form.

https://ցօ.com/ is using Armenian IDN characters.

In the case of this website the characters are a legitimate and honest use of an IDN but I'm sure you can see how these characters and the IDN system can be manipulated to trick you into thinking you're accessing a website that you're not.

Amazon AWS, Google and CloudFlare all support IDN's and you can set one up for email and websites but you can also expect to encounter some issues.

As it stands IDN's aren't very practical to use because Google in particular punishes IDN's hard and assumes IDN's are evil by default.  They do this because IDN's are often used in phishing scams.

Firefox approach is completely different, it displays the domain as https://ցօ.com/


If you click the padlock icon in Firefox you'll also see a notice telling you the domain is secure, and in this case the security certificate is Verified by CloudFlare, Inc.

What does this mean for you?  The site you're visiting may not be what you think.

After visiting this site in Firefox and seeing how it looks I want you to manually type go.com into the address bar and see where it takes you.

See the problem?

Feel free to follow me on Twitter and send a DM if you have any questions.

That's all for now, Adam out!