Fix this week

A link on your page points to a look-alike address

What it means

Web addresses can include letters from other alphabets, such as münchen.de. Behind the scenes, those addresses are stored in a plain form called punycode, which starts with xn--. So münchen.de becomes xn--mnchen-3ya.de. EverThread found a link on your page with xn-- in its address.

The same system can be abused. Some letters in other alphabets look identical to English ones. For example, xn--pypal-4ve.com displays as "pаypal.com", but its "а" is a Cyrillic letter, so it is a completely different website from the real one. Scammers register addresses like this to build convincing fake login and payment pages.

Why it matters

A link on your site carries your trust. If it leads to a fake bank, payment or login page, your visitors may hand over their details because they reached it from a business they know.

If you did not add it, someone else could post links on your site. That might only be a spam comment, or it might mean someone got into your site. Either way it is worth dealing with this week.

How to check your own site

1. Find the link. View the page source (Ctrl+U, or Cmd+Option+U on a Mac) and search for xn--. Look at the link text next to it, which is what visitors see.
2. Hover over the link rather than clicking it. Compare the address with what the link text claims. A link that says "Pay with PayPal" but goes to an xn-- address is a clear warning sign.
3. Ask whether the address could be genuine. A supplier, partner or local business with an accented or non-English name may legitimately use one. If you know them, check the address against their business card, invoice or email.
4. Note where it sits: in a blog comment, a review, a forum post, a page you wrote, or the footer or menu that appears on every page. That tells you who could have added it.

How to fix it

Any website

1. If the address belongs to someone you really link to, keep it and acknowledge the finding in your EverThread dashboard.
2. If you do not recognize it, remove the link. Then search the rest of your site for xn-- and for the same domain, since spam rarely arrives alone.
3. If it came from a comment, review or user profile, turn on moderation so new posts with links need your approval.
4. If it is in content you wrote, or in your template, footer or menu, treat the site as hacked. Back up the site, change the admin, hosting, FTP and database passwords, remove admin users you do not recognize, and update everything. The spam cleanup guide covers a full cleanup, including asking Google to recheck.

WordPress

1. Under Settings, Discussion, turn on "Comment must be manually approved", and set comments with one or more links to be held for moderation. If you do not use comments, you can turn them off for new posts on the same screen.
2. Delete spam comments, and check Users for accounts you do not recognize, especially ones with author or administrator access.
3. Check menus and widgets under Appearance, and search your posts and pages for xn--.

Shopify, Squarespace, Wix and other hosted builders

1. Check blog comments, product reviews and any community or forum features, and turn on approval for new posts if the platform offers it.
2. Check your navigation menus, footer, and custom code areas: the theme code on Shopify, Code Injection on Squarespace, and Custom Code on Wix.
3. If you did not add a link in your own content, change your password, turn on two-step verification, review staff accounts and apps, and contact platform support.

cPanel hosting

1. If the link is in a template rather than a page or comment, search your files for xn--. If your plan includes Terminal, the command in the developer section does this. Otherwise ask your host.
2. In File Manager, sort by Last Modified to see whether other files changed around the same time.

What to send your developer

The check flags any rendered <a href> whose URL contains xn--, the ACE prefix for internationalized domain names encoded with Punycode. Decode the hostname to see what users read, confirm intent, and remove it if injected. If it came from user-generated content, add moderation and consider rel="ugc nofollow" on those links.

node -e "console.log(require('node:url').domainToUnicode('xn--pypal-4ve.com'))"
grep -rIn "xn--" public_html/
wp db search "xn--" --all-tables

Common questions