The Human-Readable Promise of Ethereum Name Service (ENS)
The Ethereum Name Service (ENS) replaces complex 42-character hexadecimal addresses (e.g., 0xd8da6bf26964af9d7eed9e03e53415d37aa96045) with human-readable domains like vitalik.eth. However, cybercriminals exploit Unicode standardization to create devastating ENS Homograph Phishing Attacks.
The Anatomy of an Internationalized Domain Name (IDN) Attack
In the UTF-8 Unicode character set, multiple independent alphabets (Latin, Cyrillic, Greek) contain visually indistinguishable characters known as Homoglyphs:
| Displayed Character | Alphabet / Script | Unicode Hex Value |
|---|---|---|
| a | Latin Small Letter A | U+0061 |
| а | Cyrillic Small Letter A | U+0430 |
How Scammers Steal Transfers
- Registering Confusable Domains: The scammer registers
vitаlik.eth(using Cyrillicа) and binds it to their drainer wallet address. - Pasting in OTC Chatrooms: When facilitating an Over-The-Counter (OTC) crypto trade on Telegram or Discord, the scammer provides the lookalike domain.
- Zero-Width Space Injection: Attackers insert invisible zero-width spaces (
U+200B) into copyable text, tricking web wallets into resolving an entirely different address.
Protection Protocol: ENS Normalization Standard (ENSIP-15)
Modern Web3 wallets (MetaMask, Rainbow) implement ENSIP-15 Normalization: actively checking Punycode strings and displaying severe visual warnings whenever mixed scripts or confusable homoglyphs are detected.
Review our analysis on Permit2 and eth_sign crypto drainer exploits.
Verify your connection security on our free Web3 network inspector.