Microsoft Outlook shows real person’s contact info for IDN phishing emails

Enlarge (credit: Drew Angerer | Getty Images )

If you receive an email from someone@arstechnіca. com , is it really from someone at Ars? Most definitely not—the domain in that email address will be not the same arstechnica. com that you know. The ‘і’ character in there is usually from the Cyrillic script and not the Latin alphabet.

This isn’t a novel problem, either. Up until a few years ago (but not anymore), modern browsers did not make any visible distinction when domains containing mixed character sets were typed into the address bar.

And it turns out Microsoft Outlook is no exception, but the problem just got worse: emails originating from a lookalike domain in Outlook would show the contact card of the real person, who is actually registered to the legitimate domain name, not the lookalike address.