Latest Posts
What is a Homoglyph Attack?
September 22, 2026
A homoglyph attack (also known as an Internationalized Domain Name homograph attack or script spoofing) is a social engineering and domain-spoofing technique in which attackers use visually similar characters to imitate legitimate domains, URLs, or other digital identifiers.
Attackers take advantage of the way different writing systems are supported online. By replacing certain characters with similar-looking characters from another script, they create fake websites or links that appear almost identical to trusted ones, making them difficult for users to identify.
Technical Mechanics: Unicode, IDN, and Punycode Translation
Web browsers and applications use the Internationalizing Domain Names in Applications (IDNA) system to support domain names containing characters beyond the standard English alphabet. Since the Domain Name System (DNS) traditionally relies on ASCII characters, non-ASCII characters are converted into a format called Punycode. These encoded domains normally begin with xn --.
Attackers take advantage of characters that look similar across different writing systems:
-
Latin a (U+0061) vs. Cyrillic а (U+0430)
:
These characters can look almost identical, but they are different Unicode characters. -
Target Domain
:
example.com
-
Spoofed Domain
:
exаmple.com using a Cyrillic а
-
Punycode
:
The spoofed domain is represented in Punycode, such as xn--exmple-e1a.com.
When a user visits a lookalike domain, the browser connects to the attacker-controlled website. The site may imitate a legitimate login page and attempt to collect passwords, authentication codes, financial information, or other sensitive data.
Primary Threat Vectors
Spear-Phishing and Credential TheftAttackers can register lookalike versions of corporate portals, email services, SSO pages, and other trusted websites. These links may appear legitimate in emails or messages, increasing the chance that users will click them.
-
Software Supply Chain Attacks
Similar-looking package names can be used in public software repositories such as PyPI, npm, and RubyGems. A developer may accidentally install a malicious package because its name closely resembles a legitimate dependency.
-
Security Control Evasion
Attackers may use visually similar Unicode characters in application inputs or URLs to bypass basic security checks that rely only on exact character matching. Poorly designed input validation can therefore miss certain spoofed or altered values.
Technical Mitigation and Defensive Controls
Protecting against homoglyph attacks requires controls across browsers, DNS, applications, and domain monitoring:
-
IDN Display ControlsModern browsers use various rules to identify suspicious or mixed-script domain names. Depending on the browser and domain, suspicious names may be displayed in Punycode rather than their Unicode form.
-
DNS Security and Filtering
Enterprise DNS security controls can monitor domain requests and identify suspicious Punycode domains, unusual character combinations, and known malicious domains.
-
Attack Surface Monitoring
Security teams can monitor newly registered domains that resemble company names, brands, or legitimate services. Early detection can help identify potential phishing infrastructure before it is used against employees or customers.
-
Input Validation
Web applications should properly handle Unicode characters and normalise inputs where appropriate. Security controls should not rely solely on simple ASCII-based pattern matching.
Modern Threat Protection with StrongBox IT
Homoglyph attacks can make malicious domains appear almost identical to legitimate websites. At StrongBox IT, we help organisations identify and monitor these risks through domain monitoring, attack surface assessment, and web application security services.
-
Domain and Brand Monitoring
Monitor domain registrations and identify lookalike or Punycode domains that may be used to imitate corporate websites or brands.
-
Continuous Attack Surface Scanning
Identify exposed domains, services, applications, and other internet-facing assets that could be targeted by attackers.
-
Web Application Security
Assess applications and APIs for weaknesses in input validation, Unicode handling, authentication, and other security controls that could support spoofing or evasion techniques.
