Homoglyphs are characters from different scripts that render identically or near-identically. The classic example is Cyrillic а (U+0430) vs Latin a (U+0061) — indistinguishable in most fonts, but different Unicode code points.
The Attack
An attacker registers an internationalized domain that visually matches a target brand — for example аpple.com where the first a is Cyrillic. Encoded as Punycode this becomes xn--pple-43d.com. If a browser renders it as Unicode, users see the “real” brand and fall for the phishing page.
Common Confusable Pairs
| Latin | Look-alike |
|---|---|
| a | а (Cyrillic), α (Greek) |
| e | е (Cyrillic) |
| o | о (Cyrillic), Ο (Greek) |
| p | р (Cyrillic) |
| c | с (Cyrillic) |
| l | I (Latin capital i), 1 (digit one), ǀ (dental click) |
| 0 | O (Latin capital o) |
Defence
- Enforce browsers’ script-restriction rules (browsers try to prefer Punycode when a label mixes scripts)
- Continuously monitor for homoglyph registrations of your brand
- Use link-preview services that flag mixed-script URLs
Related
Check the Punycode glossary entry, read what typosquatting is, and see what a phishing link is.