What Is a Homograph Attack? How Fake Domains Use Lookalike Characters

A homograph attack is one of the most deceptive domain impersonation techniques used in phishing campaigns. Instead of misspelling a domain, attackers replace letters with visually similar Unicode characters that look almost identical to normal Latin letters.

To most users, a homograph domain appears completely legitimate. Even experienced internet users can miss the difference without carefully inspecting the underlying domain.

This guide explains how homograph attacks work, why they are dangerous, how Punycode is involved, real-world examples, detection techniques, and how to protect yourself from lookalike domains.

What is a homograph attack?
How homograph attacks work
Unicode and Punycode explained
Real-world examples
Homograph attacks vs typosquatting
Why attackers use homograph domains
How browsers handle Punycode
How to detect homograph attacks
Business risks
FAQ

What Is a Homograph Attack?

A homograph attack occurs when attackers register domains that contain visually similar characters from different writing systems. The resulting domain appears to be a trusted website even though it is controlled by an attacker.

For example, a Cyrillic character may visually resemble a Latin character. To the human eye, the two characters look nearly identical.

Attackers exploit this similarity to create convincing phishing domains.

How Homograph Attacks Work

Step 1. A Trusted Brand Is Chosen

Attackers typically target recognizable companies such as:

Google
Microsoft
Amazon
PayPal
Apple
Facebook

Step 2. Similar Unicode Characters Are Selected

Characters from Cyrillic, Greek, or other alphabets are substituted for Latin letters.

Step 3. The Domain Is Registered

The domain appears legitimate when displayed in many contexts.

Step 4. Victims Visit the Site

Users arrive through phishing emails, QR codes, SMS messages, advertisements, or malicious redirects.

Step 5. The Attack Is Executed

The victim may enter credentials, payment information, or other sensitive data.

Unicode Explained

The internet supports many writing systems through Unicode.

Unicode allows domains to contain characters from multiple alphabets, including:

Latin
Cyrillic
Greek
Arabic
Chinese
Japanese

This internationalization is useful for legitimate websites but can also be abused by attackers.

What Is Punycode?

Punycode is an encoding system that converts Unicode domain names into an ASCII-compatible format used by DNS.

For example:

xn--example-domain

Many browsers internally convert Unicode domains into Punycode before performing DNS lookups.

When analyzing suspicious URLs, Punycode is often a strong indicator that additional inspection is required.

Real-World Homograph Examples

These examples are simplified illustrations.

Legitimate Domain	Homograph Version
paypal.com	Uses visually similar Unicode characters
apple.com	Uses Unicode substitutions
google.com	Uses mixed alphabets

To the average user, both versions may appear identical.

Homograph Attacks vs Typosquatting

Homograph Attack	Typosquatting
Uses Unicode lookalikes	Uses spelling variations
Often visually identical	Usually visibly different
Uses character substitution	Uses typing mistakes

Both techniques are frequently used in phishing campaigns.

Why Homograph Attacks Are Effective

Homograph attacks exploit human perception.

Users often:

Trust familiar brands
Do not inspect URLs carefully
Use mobile devices
Click links from emails and SMS messages
Focus on page appearance rather than domains

This makes homograph domains highly effective phishing tools.

How Browsers Handle Punycode

Modern browsers implement protections against certain homograph attacks.

Depending on the browser and configuration:

The Unicode version may be displayed.
The Punycode version may be displayed.
Suspicious mixed-script domains may be flagged.

Browser protections help but do not eliminate the risk.

How To Detect Homograph Attacks

Inspect domains carefully.
Look for unusual Unicode characters.
Check whether the domain uses Punycode.
Inspect redirects.
Verify brand ownership.
Analyze suspicious URLs before opening them.

2check.click can identify Punycode domains, Unicode-based impersonation attempts, lookalike domains, and other phishing indicators associated with homograph attacks.

Warning Signs

Unexpected login requests
Brand impersonation
Punycode domains
Mixed alphabets
Suspicious redirects
Recently registered domains

Business Risks

Organizations face significant risks from homograph attacks.

Potential consequences include:

Credential theft
Business email compromise
Financial fraud
Malware delivery
Brand abuse
Customer trust erosion

Protection Checklist

Inspect domains carefully.
Use password managers.
Enable MFA.
Verify suspicious requests independently.
Check Punycode representations.
Analyze suspicious URLs before visiting them.

Frequently Asked Questions

What is a homograph attack?

A phishing technique that uses visually similar Unicode characters to impersonate legitimate domains.

What is Punycode?

An encoding system that converts Unicode domains into ASCII-compatible representations used by DNS.

Are homograph attacks common?

Yes. They are regularly used in phishing and brand impersonation campaigns.

Can HTTPS stop homograph attacks?

No. Homograph domains can also obtain HTTPS certificates.

Related Guides

Final Thoughts

Homograph attacks are particularly dangerous because they exploit the way humans visually interpret domain names. A malicious domain may look identical to a legitimate website while directing users to an attacker-controlled destination.

Understanding Punycode, Unicode domains, and lookalike characters helps users identify one of the most sophisticated forms of phishing domain impersonation.

Need to inspect a suspicious domain? Analyze it with 2check.click before visiting it.