What is an IDN Homograph Attack?

An IDN (Internationalized Domain Name) homograph attack occurs when an attacker registers a domain name that looks visually identical to a legitimate brand using lookalike characters from other alphabets (such as Cyrillic "а" U+0430 replacing Latin "a" U+0061). To the human eye, "apple.com" appears genuine, but the browser navigates to the attacker's malicious server.

How do modern web browsers protect against homoglyph phishing?

Browsers like Chrome, Firefox, and Safari employ UTS #39 security profiles. If a domain combines multiple incompatible scripts in suspicious contexts, the browser automatically displays the raw Punycode representation (e.g. "xn--pple-43d.com") instead of the rendered Unicode glyphs.

How can developers prevent homoglyph attacks in registration systems?

Developers should enforce NFKC normalization and validate usernames against the Unicode Confusables database (UTS #39) during registration, prohibiting mixed-script usernames that mimic existing accounts or administrators.

Tools/Homoglyph Security Scanner

Homoglyph & Confusable Security Scanner (Phishing & Spoofing Audit)

Audit domains, usernames, and source code for deceptive cross-script lookalikes (Cyrillic, Greek, Latin) and neutralize homograph phishing attacks.

Input String or URL to Audit

https://www.gооgle.com/login?user=аdmin

Security Threat Detected: 3 Deceptive Homoglyphs Found

This string contains foreign script characters that visually mimic Latin ASCII letters.

Neutralized Clean Version:https://www.google.com/login?user=admin

Detected Lookalike Characters Breakdown

Below is the list of deceptive characters detected in your input string, showing their true Unicode origin versus their visual ASCII lookalike.

Position	Deceptive Glyph	Unicode Codepoint	True Script Origin	Visual Latin Target	Character Name
#13	о	U+043E	Cyrillic	→ o	CYRILLIC SMALL LETTER O (U+043E)
#14	о	U+043E	Cyrillic	→ o	CYRILLIC SMALL LETTER O (U+043E)
#34	а	U+0430	Cyrillic	→ a	CYRILLIC SMALL LETTER A (U+0430)

Understanding Unicode Homoglyph Attacks & UTS #39 Security Standards

A homoglyph is a character that shares an identical or near-identical visual shape with a completely different character from another alphabet. For instance, the Cyrillic letter а (U+0430) and the Latin letter a (U+0061) are indistinguishable in standard sans-serif system fonts.

Cybercriminals exploit these lookalikes to execute IDN Homograph Phishing Attacks, registering deceptive URLs (e.g. аррӏе.com) to steal credentials, bypass Web Application Firewalls (WAF), or impersonate company administrators on Slack, GitHub, and internal corporate portals.

How iloveunicode.com Homoglyph Scanner Protects You

•Cross-Script Auditing: Detects Cyrillic, Greek, Armenian, and Cherokee lookalikes mixed into Latin strings.
•1-Click Neutralization: Translates deceptive characters directly to their safe standard ASCII equivalents.
•UTS #39 Compliant: Built on the Unicode Consortium’s official Confusables dataset.
•Zero Network Logging: All scanning runs 100% client-side in browser memory — your sensitive URLs and credentials are never stored.

Frequently Asked Questions (FAQs)

How can I detect homoglyphs in source code or dependency names (e.g. npm / PyPI)?+

Paste your package names or code snippets into this scanner. The tool highlights all non-ASCII Cyrillic, Greek, or Cherokee characters that attackers frequently inject into typosquatting packages.

Can homoglyphs bypass Web Application Firewalls (WAF)?+

Yes, attackers often replace ASCII characters with Unicode homoglyphs (e.g. using Cyrillic "s" in "select" or "script") to bypass naive regex keyword filters. Sanitizing user input with this scanner neutralizes such evasion techniques.

What is Punycode and how does it relate to homoglyphs?+

Punycode is an ASCII-compatible encoding (ACE) used by the Domain Name System (DNS) to represent international Unicode domain names. For example, a domain containing Cyrillic "а" is encoded by DNS as "xn--...".