Homograph Attack

A homograph attack exploits characters that look alike but are, to a computer, entirely different: the Cyrillic "а" and the Latin "a", the digit "0" and the letter "O", a capital "I" and a lowercase "l". An attacker registers a domain or crafts a sender name using these doppelgängers, producing text that passes human inspection perfectly — because to human eyes there is nothing to inspect. "Check the URL carefully" is standard security advice; homograph attacks are built to survive exactly that check.

How it works

The strongest variant abuses internationalized domain names (IDN), which let domains contain non-ASCII characters. A registered name like "аpple.com" — with a Cyrillic first letter — is stored by the infrastructure as an encoded string ("xn--80ak6aa92e.com"), but a browser may render the lookalike glyphs, and a link in an email almost always does. The attacker puts a cloned login page behind it, obtains a legitimate TLS certificate for the encoded name — so the padlock appears — and delivers the link by email, chat, or ad.

Simpler ASCII homoglyphs do most of the everyday damage: rnicrosoft.com ("rn" for "m"), paypa1.com, G00gle. These power lookalike domains used in credential phishing and invoice fraud, and they extend beyond URLs — display names, file names ("Invoice.pdf" vs "Ιnvoice.pdf"), and even code-package names in supply-chain attacks use the same trick. Homograph domains differ from typosquatting: a typosquat waits for the victim to make a mistake, while a homograph is delivered to the victim already disguised.

How to defend against it

• Stop relying on eyeballs. Train employees to navigate to sensitive sites via bookmarks or a password manager, which will refuse to autofill on a homograph domain it has never seen — turning a visual trap into a technical alarm.
• Filter at the infrastructure layer. Email security and DNS filtering that flag IDN-encoded and newly registered lookalike domains catch what inspection cannot; most modern browsers already render suspicious mixed-script domains in encoded form.
• Monitor your own brand for homograph registrations and pursue takedowns before the domains go live in campaigns.
• Teach the limits of "check the URL" in security awareness training: the lesson is not to look harder, but to verify through channels that cannot be visually forged.