Homoglyph Attacks: How Lookalike Characters Spoof Domains and Brands

“pаypal.com” looks exactly like “paypal.com”, but the first “a” is a Cyrillic а (U+0430), not the Latin a (U+0061) — a different character that happens to look identical, pointing to a different address. This is a homoglyph attack, and because your eyes physically cannot tell the two apart, the only reliable defence is to check the underlying code points. Do that instantly with the homoglyph detector; here’s how the trick works.

The trick, in one picture

What a homoglyph is

Unicode contains many characters that look (nearly) identical but live in different scripts. The Cyrillic alphabet alone supplies convincing stand-ins for a, e, o, p, c, y and x; Greek adds ο, ν, α and more; and the full-width Latin block gives Ａ, Ｅ, Ｏ. Because a well-designed font draws them the same, “аpple”, “раypal” and “gооgle” can each be written with a foreign letter hiding in plain sight. Unicode even publishes a “confusables” list precisely so software can catch them.

Why it’s dangerous

Substituting one lookalike character lets an attacker imitate a trusted name:

• Domains (IDN homograph attacks). A registered domain like “pаypal.com” resolves to the attacker’s server while looking like the real brand — the basis of many phishing pages.
• Email and display names. A “From” name or address with a swapped character sails past a quick glance.
• Brand and username impersonation. Social handles and package names use homoglyphs to pass as the real thing.

Modern browsers fight back by showing punycode (an xn--… form) for suspicious mixed-script domains, but homoglyphs still turn up in links, names and pasted text where no such warning appears.

The giveaway: mixed scripts

Here’s the tell that catches almost every homoglyph: legitimate words are written in a single script. An English word is all Latin letters; a Russian word is all Cyrillic. So when a single word contains both — a Latin “p” next to a Cyrillic “а” — something has been substituted. The homoglyph detector flags exactly this “mixed scripts” condition and lists each offending character with its code point and the ASCII letter it imitates.

How to check text for homoglyphs

1. Paste the suspicious text — a link, an email address, a brand name — into the homoglyph detector.
2. It lists every lookalike character, its script (Cyrillic, Greek, full-width…) and the ASCII letter it mimics, and warns if scripts are mixed.
3. It shows an ASCII-normalised version so you can see the “real” intended string.

For a deeper look at exactly what a string contains — code points, categories and bytes — pair it with the Unicode character inspector, and check the same text for invisible characters, the other half of the text-forensics toolkit. Everything runs in your browser, so pasting a suspicious link never sends it anywhere.

Quick summary

Homoglyphs are characters from other scripts (Cyrillic а, Greek ο, full-width Ａ) that look identical to ASCII letters, and swapping one in lets attackers spoof domains, emails and brands — an IDN homograph attack. Your eyes can’t tell them apart, but the substitution always shows up as mixed scripts in the underlying code points. Check any suspicious text with the homoglyph detector — instantly, and privately.

Sources: Unicode Technical Standard #39, Security Mechanisms (confusables) · IDN homograph attack (general security literature). Educational information — not a substitute for your organisation’s security controls.