A homoglyph attack is a domain-spoofing technique where an attacker registers a domain that swaps one or more characters for visually identical ones, such as a Cyrillic "а" in place of a Latin "a", so the fake address looks exactly like yours. Victims see a familiar domain in a link, email, or browser bar and trust it, while their traffic, credentials, or payments go to the attacker.
Homoglyph attacks are a specialized form of typosquatting. Typosquatting relies on people mistyping a domain. Homoglyph spoofing relies on people *reading* a fake domain correctly and still being fooled, which makes it harder to catch by eye.
How a Homoglyph Attack Works
Homoglyphs are characters that look the same, or nearly the same, but have different underlying codes. Computers compare domains by code, not appearance. To a DNS resolver, "example.com" with a Latin "a" and "exаmple.com" with a Cyrillic "а" are two completely unrelated domains that can have different owners.
The attack follows a predictable sequence:
- Pick a target. The attacker chooses a brand whose customers or employees log in, pay invoices, or download software.
- Find a convincing swap. They identify characters in the brand name that have lookalikes in other scripts or in plain ASCII.
- Register the lookalike. Many registries accept internationalized domain names, so the spoofed domain is legal to register.
- Add infrastructure. They configure DNS, often set up MX records so the domain can send and receive email, and obtain a free TLS certificate so the site shows a padlock.
- Deliver the lure. The domain shows up in phishing emails, fake invoices, ads, social posts, or messages impersonating your support team.
The padlock is worth stressing. A TLS certificate proves only that the visitor is connected to the domain shown. It says nothing about whether that domain belongs to you. Attackers can get certificates for lookalike domains as easily as anyone else.
The Two Main Types of Homoglyph Spoofing
IDN homoglyphs (Unicode lookalikes)
Internationalized Domain Names (IDNs) let domains include non-Latin characters, which is essential for languages written in Cyrillic, Greek, Arabic, Chinese, and many other scripts. Under the hood, the domain system only handles ASCII. IDNs are converted to an ASCII form called Punycode, which always starts with the prefix "xn--".
A user might see "exаmple.com" on screen while the actual registered domain is an "xn--" string. Common cross-script confusables include:
- Cyrillic а, е, о, р, с, х, and у, which mimic their Latin counterparts
- Greek ο (omicron) and ν (nu), which pass for Latin "o" and "v"
- Characters with tiny diacritics, such as ė or ȧ, that disappear at small font sizes
Modern browsers apply display rules to IDNs. If a domain mixes scripts in suspicious ways, or if a whole-script lookalike resembles a well-known domain, many browsers show the raw "xn--" Punycode instead of the Unicode version. Many registries also limit mixing scripts within a single label. These protections reduce the risk but don't remove it. Whole-script spoofs, where every character comes from one non-Latin script, can still slip through in some contexts. Email clients, chat apps, PDFs, and documents often render the Unicode version with no warning at all.
ASCII homoglyphs (no Unicode required)
You don't need exotic characters to fool a reader. Plain ASCII offers plenty of confusable pairs, especially in sans-serif fonts:
- rn vs. m: "exarnple.com" reads as "example.com" at a glance
- l vs. 1 vs. I: "examp1e.com" or "exampIe.com"
- 0 vs. O: a zero in place of a capital or lowercase "o"
- vv vs. w: two v's standing in for a w
- cl vs. d: "cl" crammed together resembles "d"
These domains render the same way everywhere, so no browser or Punycode display rule will flag them.
Combined tricks
Attackers often stack a homoglyph with other techniques. They might use a TLD swap (example.net instead of example.com), a subdomain trick (example.com.example.net, where the real domain is the last part), or combosquatting (example-login.com). A single homoglyph in an otherwise official-looking URL gets past more people than any one trick alone.
Why Homoglyph Attacks Succeed
People don't read domains letter by letter. They recognize word shapes, especially on phones where address bars are truncated and fonts are small. Homoglyph spoofing exploits that habit. The attacker isn't counting on carelessness, just on normal reading.
They also succeed because the fake infrastructure is real. A lookalike domain with valid MX records can pass basic email authentication for *its own* domain, so SPF, DKIM, and DMARC on your domain won't block it. Those controls stop attackers from spoofing your exact domain, not from registering a different one that looks like it.
How to Spot a Homoglyph Domain
Train staff and customers to check for these signs, particularly before entering credentials or approving payments:
- An address that begins with or contains "xn--" where you expected a plain brand name
- Letters that look slightly off in weight, spacing, or height compared with surrounding text
- "rn," "vv," "cl," "1," or "0" in places your brand name never uses them
- Unexpected urgency: password resets, invoice changes, or account warnings you didn't trigger
- A link whose displayed text differs from the destination shown on hover or long-press
Typing your domain directly or using a saved bookmark sidesteps the problem for users. It doesn't protect anyone who clicks first.
How to Protect Your Brand from Homoglyph Attacks
Prevention combines defensive registration with continuous monitoring.
- Register your highest-risk variants. Secure the most convincing ASCII swaps of your primary domain and the main TLDs you operate in. You can't register every permutation, so prioritize the ones closest to your real name.
- Lock down your own email. Enforce DMARC at a reject policy so attackers can't use your exact domain, which pushes them toward lookalikes you can detect.
- Publish one official domain list. Tell customers which domains you send from and which you will never use, so suspicious messages stand out.
- Monitor for new lookalikes continuously. Homoglyph domains are often registered, issued a TLS certificate, and used within a short window. dokyma.com generates homoglyph and typosquat permutations of your brand, checks which ones are registered, inspects their DNS, MX records, and WHOIS data, and watches certificate transparency logs for new certificates issued to lookalike names, so you see the threat before the phishing campaign launches.
- Have a takedown process ready. Once a malicious lookalike is confirmed, gather evidence (screenshots, DNS and certificate details, sample phishing messages) and file abuse reports with the registrar and hosting provider. Warn customers and staff while the takedown is in progress.
Check Which Lookalikes of Your Domain Already Exist
The fastest way to understand your exposure is to see what's already registered. Run a free brand scan at dokyma.com: enter your domain, and Dokyma will list homoglyph, IDN, and typosquat variants that exist today, flag the ones with live mail servers or fresh TLS certificates, and show you which to register, monitor, or take down first.