What Is a Homograph Attack? Homoglyph Phishing Explained
Answer: A homograph attack is a phishing technique where attackers register a domain that looks identical to a legitimate one, but uses substituted characters from different alphabets (homoglyphs). For example, pаypal.com with a Cyrillic "а" instead of a Latin "a" — visually indistinguishable, but an entirely different domain. These attacks are increasing in 2026 because attackers can now obtain valid HTTPS certificates for homoglyph domains, making them appear fully legitimate.
How homograph attacks work
The attack exploits the Internationalized Domain Name (IDN) system, which allows domain names to use Unicode characters from any alphabet. This was designed to support non-Latin scripts like Arabic, Chinese, and Cyrillic. However, many characters across different alphabets look identical:
Latin "a" (U+0061) vs Cyrillic "а" (U+0430)
Visually identical in most fonts — the basis of the PayPal homograph attack.
Latin "o" (U+006F) vs Greek "ο" (U+03BF)
Used in the Amazon homograph attack — the domain even got a valid HTTPS certificate.
Latin "l" vs Capital "I" (U+0049)
In sans-serif fonts, these are indistinguishable — used in googIe.com and PayPaI.com scams.
"r" + "n" vs "m"
In many fonts, "rn" looks like "m" — used in rnicrosoft.com.
When a browser encounters a domain with non-Latin characters, it converts it to Punycode — an ASCII representation starting with xn--. For example, the Cyrillic pаypal.com becomes xn--pypal-4ve.com. Modern browsers show the original Unicode in the address bar, which is what makes the attack work.
Why homograph attacks are increasing in 2026
- Valid HTTPS certificates: Certificate Authorities now issue SSL certificates for internationalized domains, so the browser shows the padlock icon — a signal users have been trained to trust.
- AI-powered phishing at scale: Generative AI makes it trivial to create convincing phishing pages and email content, so attackers focus on the domain as the remaining trust signal to exploit.
- Email display name spoofing: Attackers use homoglyphs in email From: display names, not just domains, so the sender appears legitimate even in email clients that hide the actual address.
- Mobile browsing: Mobile browsers often hide the full URL or show only the domain, making homoglyph substitution harder to spot on small screens.
Real-world homograph attack cases
| Domain | Substitution | Target | Source |
|---|---|---|---|
| pаypal.com | Cyrillic "а" (U+0430) replacing Latin "a" | PayPal credential harvesting | Palo Alto Unit 42 |
| amazοn.com | Greek omicron "ο" (U+03BF) replacing Latin "o" | Amazon with valid HTTPS certificate | Soluble / Matt Hamilton |
| rnicrosoft.com | "r" + "n" visually resembling "m" | Microsoft credential theft | Wikipedia IDN homograph |
| googIe.com | Capital "I" replacing lowercase "l" | Google look-alike | Wikipedia IDN homograph |
| PayPaI.com | Capital "I" replacing lowercase "l" in PayPal | PayPal phishing scam | Wikipedia IDN homograph |
Signs of a homograph attack
- A domain name where one or more characters are from a different alphabet (Cyrillic, Greek, Latin)
- The browser address bar shows xn-- prefix (Punycode) instead of the expected domain name
- The URL looks correct at a glance but feels slightly "off" in a way you cannot identify
- A link in an email shows one domain when hovered but the page looks like a different brand
- The site has a valid HTTPS certificate but the domain does not exactly match the brand
- Email sender display name uses Unicode characters that look like ASCII but are not
What to do if you encounter a homograph domain
- 1Do not click the link. Hover over it first to reveal the actual destination URL.
- 2Check for Punycode in the address bar: domains starting with xn-- are using internationalized characters.
- 3Copy the URL and paste it into PhishGlass to check for homoglyph character substitution.
- 4If you already entered credentials, change your password immediately on the legitimate site.
- 5Enable multi-factor authentication on the affected account.
- 6Report the homograph domain to the legitimate brand's abuse team and to Google Safe Browsing.
How PhishGlass detects homograph attacks
PhishGlass analyzes every URL for Unicode character substitution across Latin, Cyrillic, Greek, and other scripts. When a domain contains mixed-script characters — even if the browser displays it as a familiar brand — PhishGlass flags the specific homoglyph substitution, identifies the original brand being impersonated, and assigns a risk score based on the attack pattern.
In our 2026-10-20 testing, PhishGlass was the only tool that specifically detected homograph attacks. Norton Genie and Bitdefender Scamio flagged the URLs as scams but did not identify the homoglyph character substitution technique.