Homograph Attacks: How Hackers Trick You With Look-Alike Domains

Understanding Homograph Attacks: How Cybercriminals Exploit Visual Similarities

In the pre-computer era, the visual and optical similarity of certain written characters enabled the simplification of typewriter construction, reducing the number of keys on keyboards and thereby saving resources. Today, cybercriminals exploit these similarities through homograph attacks, where users cannot visually distinguish characters, leading to phishing and domain spoofing risks.

The aforementioned saving involved removing the “0” and “1” keys from keyboards, which were successfully replaced by the capital “O” and lowercase “l.” It was left to humans to interpret whether these symbols represented digits or letters. The need to avoid confusing zero with “o” gave rise to the tradition of crossing zeros, so that computer operators would have no doubts about what they were entering.

This similarity is referred to as homographs (when it concerns words) or homoglyphs when it applies to individual characters.

Deliberate substitution of similar-looking characters from different alphabets has also been practiced for entertainment purposes (e.g., Faux Cyrillic). Volapük encoding, in which Latin characters represent Cyrillic ones based on visual similarity, was used in the early days of the Internet as a way to overcome the lack of support for Cyrillic.

The problem emerged when cybercriminals recognized homographs, and the fact that users cannot visually distinguish these characters from one another created a new potential attack vector. Modern homograph attacks exploit these visual tricks in phishing emails, fraudulent domains, and fake websites, making it difficult for users to detect malicious intent.

What Is a Homograph Attack?

A homograph attack occurs when attackers replace characters in a URL or domain name with visually similar alternatives from different alphabets or encoding systems. To the human eye, the domain looks legitimate, but it directs users to a malicious site. These attacks often rely on homoglyphs, characters that appear identical to humans but are interpreted differently by computers.

These attacks are particularly dangerous because they bypass standard user vigilance. Even careful users may be tricked by a familiar-looking domain. Homograph attacks are commonly used in phishing campaigns, where attackers aim to steal credentials, spread malware, or intercept communications.

Example:
A user tries to visit www.paypaI.com (with a lowercase “l” replaced by the uppercase “i”) instead of the legitimate www.paypal.com. If the attacker hosts a fake login page, victims may unknowingly disclose sensitive information.

ASCII and Unicode Foundations

Homographs first appeared in character encoding systems, creating one of the earliest attack vectors for cybercriminals. The ASCII system, a 7-bit encoding standard used in early computers, has only 94 printable characters. Certain character combinations can look alike—for example, “r” and “n” can visually resemble “m,” enabling domains like rnicrosoft.com to impersonate microsoft.com. Domains such as googIe.com or paypaI.com use a capital “I” instead of a lowercase “l.” Narrow fonts, like Tahoma (default in Windows XP), can generate homoglyphs such as “cl” resembling “d” or “cj” resembling “g.”

Because ASCII was limited to English letters and symbols, only a small number of visual impersonations were possible. The introduction of Unicode, however, dramatically expanded the potential for homograph attacks. Unicode supports thousands of characters from alphabets worldwide, including diacritics, accents, and multiple types of dashes. Letters from non-Latin alphabets—such as Greek or Cyrillic—can look identical to Latin characters but are processed as completely different code points. For instance, lowercase Latin “a” (U+0061) appears visually identical to lowercase Cyrillic “а” (U+0430).

The key vulnerability arises from the mismatch between human perception and computer processing. While users see a familiar Latin “a,” the computer interprets it as a different character. The IDN (Internationalized Domain Names) system allows domain names to include the full Unicode set, increasing both functionality and risk. Though IDNs enable global character use, visual similarity, rendering issues, and small fonts significantly amplify the potential for homograph attacks.

Types of Homograph Attacks

Attacks leveraging these visual tricks are collectively known as homograph attacks, though they technically involve homoglyphs (see Homographs vs. Homoglyphs). They fall into two main categories:

1. Homograph Phishing Attacks
These sophisticated phishing attacks use similar-looking characters to impersonate domains of well-known brands. The simplest example replaces letters with visually similar ones, such as “O” with “0,” creating domains like g00gle.com. These fake sites capture credentials, distribute malware, or proxy traffic without the user noticing.

2. IDN Homograph Attacks
Internationalized Domain Name attacks exploit Unicode, allowing attackers to register domains with characters from non-Latin alphabets. Characters from Greek, Cyrillic, and other scripts can look identical to Latin letters, making fake domains appear legitimate. This enables phishing, account theft, and other forms of fraud. For example, a Cyrillic “а” in a domain may look like a Latin “a,” directing users to a malicious site while seeming authentic.

These attacks are sometimes called script spoofing, a type of typosquatting where visual similarity replaces simple typos. By combining characters from different scripts, attackers can craft domains that appear identical to trusted websites, deceiving even cautious users.

Homographs vs. Homoglyphs

Homographs are words that are spelled the same but differ in pronunciation and meaning, e.g.:

• Modern
  Adjective: Up to date, contemporary.
  Example: “Das Haus ist sehr modern eingerichtet.” (The house is furnished in a very modern way.)
  Verb (1st person plural of modern): We rot.
  Example: “Wir modern im feuchten Keller.” (We rot in the damp cellar.)
• Bank
  Noun: A financial institution.
  Example: “Er arbeitet bei einer großen Bank.” (He works at a big bank.)
  Noun: A bench to sit on.
  Example: “Sie saßen zusammen auf der Bank im Park.” (They sat together on the bench in the park.)
• Lernen / lehren
  Although not perfect homographs, German learners often mix these, but better examples include:
• Schloss
  Noun: A castle or palace.
  Example: “Das Schloss Neuschwanstein ist weltberühmt.” (Neuschwanstein Castle is world-famous.)
  Noun: A lock (for a door).
  Example: “Das Schloss an der Tür ist kaputt.” (The lock on the door is broken.)
• Tau
  Noun: Dew.
  Example: “Am Morgen lag Tau auf dem Gras.” (There was dew on the grass in the morning.)
  Noun: Rope.
  Example: “Das Schiff ist mit einem starken Tau festgebunden.” (The ship is tied with a strong rope.)
• Licht
  Noun: Light (illumination).
  Example: “Mach bitte das Licht an.” (Please turn on the light.)
  Noun (archaic poetic use): Enlightenment or spiritual clarity.
  Example: “Er suchte das innere Licht.” (He sought the inner light.)

Homoglyphs, on the other hand, are different alphanumeric characters (glyphs) that look similar and can be interpreted in more than one way, e.g., the digit zero and the capital “O.”

There are many such ambiguities, some more apparent with certain fonts (e.g., capital “I,” digit one, and lowercase “l” or zero vs. “O”), others across alphabets (e.g., Latin “H” (Unicode 0048), Cyrillic “Н” (Unicode 041D), and Greek “Η” (Unicode 0397), all visually identical). In other cases, homoglyphs represent the same vowel sound, e.g., Latin “A,” Cyrillic “А,” and Greek “Α” (alpha).

Why Homograph Attacks Are Effective

These attacks exploit the fact that users naturally trust the visual appearance of domain names. By combining characters from different scripts—Latin, Cyrillic, Greek, and others—attackers can create URLs that look identical to legitimate domains. This makes phishing and credential theft more effective because even vigilant users may not notice subtle differences.

Example of IDN homograph attack:
A domain using a Cyrillic “а” in place of Latin “a” can perfectly mimic a legitimate site, tricking users into submitting sensitive information while appearing authentic.

Defense Against Homograph Attacks

Defending against homograph attacks requires both user-side awareness and server-side or registry-level measures. While the risk of these attacks was anticipated before the introduction of IDN (Internationalized Domain Names), many early recommendations were ignored by major top-level domains (TLDs). Registries were advised to limit accepted characters to the Latin alphabet or their national scripts rather than allowing all Unicode characters, but enforcement was inconsistent.

Browser-Based Defenses

For users, the simplest defense is to rely on browser security features that detect and mitigate homograph attacks. Modern browsers display IDN addresses in Punycode, revealing non-Latin characters to prevent visual spoofing. However, these defenses have limits. Malicious links can still reach users via email, social media, or websites, and malware may begin loading before the user notices the Punycode display.

Browser behavior examples:

• Google Chrome (v51+) uses an algorithm similar to Firefox, displaying IDNs only if scripts are consistent or the TLD restricts characters.
• Microsoft Edge (Chromium-based, 2019+) and Opera follow the same detection rules.
• Safari renders suspicious character sets as Punycode by default; this behavior can be changed via macOS system settings.
• Mozilla Firefox (v22+) only shows IDNs if all labels use the same script or the TLD prevents homograph attacks. Otherwise, the address appears in Punycode.

Even with these protections, users must remain vigilant, as homograph attacks combined with malware distribution can bypass Punycode detection until the link is clicked.

Server-Side and Registry Mitigation

Organizations and domain registries can implement additional measures to reduce IDN phishing risks.

• The IDN homograph database, a Python library, uses machine learning to recognize potentially malicious homoglyphs and defend against attacks.
• ICANN enforces policies that prevent internationalized TLDs from using characters resembling existing Latin TLDs. Proposed TLDs such as .бг (Bulgaria), .укр (Ukraine), and .ελ (Greece) were initially rejected due to visual similarity concerns. Later, these and other TLDs like Serbia’s .срб and Mongolia’s .мон were accepted.
• Three-letter TLDs are generally safer than two-letter ones because they are less likely to match existing ISO-3166 Latin-based country codes. High registration costs also make fraudulent homographic TLDs uneconomical and attract ICANN scrutiny.
• Some registries, like the Russian .рф, only accept Cyrillic characters for top-level domains, explicitly prohibiting mixes with Latin or Greek scripts. However, popular gTLDs such as .com still remain vulnerable to homograph attacks.

These combined measures—browser-level defenses, registry policies, and server-side tools—are essential for reducing the risk of homograph attacks. Users, developers, and domain operators all play a role in preventing spoofing, phishing, and credential theft.

Known Homograph Attacks

Homograph attacks have been documented for over two decades, demonstrating how attackers exploit visual similarity between characters to deceive users. These attacks range from proof-of-concept studies to real-world phishing campaigns.

1. December 2001 – Microsoft Cyrillic Variant

Researchers Evgeniy Gabrilovich and Alex Gontmakher from Technion (Israel) demonstrated that it was possible to register a variant of microsoft.com using Cyrillic characters. Their seminal paper, “The Homograph Attack”, showed how Unicode URLs could counterfeit legitimate addresses and trick users into visiting malicious websites.

2. February 7, 2005 – PayPal Exploit at Shmoocon

At the Shmoocon hacker conference, Eric Johanson presented a homograph exploit that redirected browsers supporting IDNA from the legitimate PayPal site to www.pаypal.com, where the first “a” was replaced with Cyrillic “а.” The fake site displayed different content and was used for phishing attacks. This event highlighted the risks of IDN phishing in popular online services. (Slashdot report)

3. 2011 – KBOI-TV April Fools’ Prank

An anonymous user registered a homographic domain similar to the TV station KBOI-TV, creating a fake news site. The site published a satirical April Fools’ joke claiming that the Idaho governor banned Justin Bieber’s music. While harmless, this attack illustrated the potential for misleading content via visually similar domains.

4. September 2017 – Betabot Trojan via adobe.com

Security researcher Ankit Anubhav discovered a Unicode homograph attack where attackers registered adoḅe.com (with a dotted “b”) to distribute the Betabot Trojan. This example demonstrates that homograph attacks are not limited to phishing; they can also deliver malware directly to unsuspecting users.

5. 2018 – Facebook Spoofing Campaign

Researchers reported IDN phishing domains like fаcebook.com (Cyrillic “а”) used to capture login credentials. These domains appeared identical to the legitimate facebook.com but led users to malicious sites designed to steal personal information.

6. 2019 – PayPal Phishing via paypaI.com

Attackers registered paypaI.com (with a capital “I”) to target unsuspecting users via email campaigns. The domain closely resembled the legitimate paypal.com, deceiving users into entering sensitive information on a fake login page.

7. 2020 – GitHub Typosquatting Attack

Malicious actors created homograph repositories with similar-looking names to official projects on GitHub. By exploiting visual similarities, they injected malware or malicious code into unsuspecting users’ systems.

8. 2021 – Cryptocurrency Exchange Phishing

Cybercriminals registered domains like bitcоin.com (Cyrillic “о”) to impersonate legitimate cryptocurrency exchanges. Users attempting to access the real site were redirected to fraudulent platforms designed to steal funds.

9. 2022 – Online Banking Login Spoofing

Attackers used homograph domains such as bankofamеrica.com (Cyrillic “е”) to mimic legitimate online banking sites. These fake sites captured login credentials, leading to unauthorized access to victims’ accounts.

10. 2023 – E-commerce Website Impersonation

Cybercriminals registered domains like amazоn.com (Cyrillic “о”) to impersonate the popular e-commerce platform. Users were tricked into entering payment information on counterfeit sites, resulting in financial losses.

These cases underline the versatility of homograph attacks, which can be used for phishing, malware distribution, content spoofing, and credential theft. Users, developers, and organizations must understand the mechanics of these attacks to prevent falling victim.

Conclusion & Best Practices

Homograph attacks exploit the visual similarity of characters across different alphabets and encoding systems, making them a persistent and subtle threat in cybersecurity. From ASCII-based tricks like rnicrosoft.com to Unicode IDN exploits such as mіcrosoft.com with Cyrillic characters, attackers leverage homoglyphs to impersonate trusted domains and deceive even vigilant users. Understanding how these attacks work is the first step in protecting yourself and your organization.

Best practices to defend against homograph attacks:

• Verify URLs carefully: Always hover over links or check the browser’s address bar for subtle differences. Punycode representation often reveals IDN homographs.
• Use browser protections: Modern browsers like Chrome, Firefox, Safari, and Edge have built-in safeguards against homograph attacks. Keep browsers updated to benefit from these defenses.
• Rely on trusted bookmarks: Access critical services such as banking or email via bookmarks or manually typed URLs rather than links in emails or messages.
• Educate users: Train employees and colleagues to recognize suspicious URLs and the risks associated with IDN homographs.
• Leverage security tools: Use password managers and anti-phishing software that validate domain authenticity before submission of credentials.

By following these guidelines, you can significantly reduce the risk of falling victim to homograph attacks and related phishing schemes.

Stay alert

Understanding the difference between homographs and homoglyphs, recognizing suspicious domains, and using the right browser and security tools are essential steps to maintain your online safety. Homograph attacks may seem subtle, but with awareness and proper defenses, they can be effectively mitigated.

For those interested in exploring cybersecurity more broadly, including ethical hacking practices, you can check out our detailed guide on What is Ethical Hacking and How to Become One. Additionally, if you’d like to learn more about our structured training programs, visit our Cybersecurity Weiterbildung program page for further opportunities.