What Are Homograph Attacks Using Lookalike Unicode Characters in a URL?

18 October 2026

A homograph attack uses characters from different alphabets or Unicode sets that look identical to standard ASCII letters, but are actually different code points. When these lookalike characters appear in a domain name, the URL appears legitimate to the human eye but resolves to a completely different website controlled by an attacker. This technique is one of the most sophisticated ways crypto phishing sites trick users into connecting their wallets or entering private keys.

How homograph attacks work

Domain names are registered as Internationalized Domain Names (IDNs), which allow non-ASCII characters like Cyrillic, Greek, or accented Latin letters. A browser or registrar treats each character as unique based on its Unicode code point, not its visual appearance. An attacker registers a domain such as binаnce.com where the first "a" is actually a Cyrillic "а" (U+0430) instead of the ASCII "a" (U+0061). To the naked eye, the address looks identical to the real binance.com.

The attack relies on the fact that many alphabets share visually identical glyphs. Common examples include:

• Cyrillic "а" (U+0430) replacing Latin "a" (U+0061)
• Cyrillic "е" (U+0435) replacing Latin "e" (U+0065)
• Cyrillic "о" (U+043E) replacing Latin "o" (U+006F)
• Cyrillic "р" (U+0440) replacing Latin "p" (U+0070)
• Greek "ο" (U+03BF) replacing Latin "o" (U+006F)

Why crypto users are a target

Crypto phishing sites that use homograph attacks often clone popular exchanges, DeFi protocols, or wallet interfaces. A fake URL like metamаsk.io (with a Cyrillic "а") could lead to a page that looks identical to the real MetaMask site. Once you connect your wallet, the attacker can drain funds through permit signatures, unlimited token approvals, or direct transaction requests - the same techniques used in smart contract front-end cloning and fake DeFi protocol sites.

These attacks bypass simple checks like domain age because the attacker can register a new homograph domain and it will appear fresh. They also evade basic URL inspection if you only glance at the domain name.

How to Detect a Homograph Attack

1. Copy and Paste the URL into a Text Editor

Highlight the domain name, copy it, and paste it into a plain text editor or a search bar. Look for characters that appear out of place. For example, if you paste metamаsk.io and see a small dot or diacritic mark on the "а", that character is not ASCII.

2. Use a Punycode Converter

Internationalized domain names are encoded as Punycode when sent over DNS. A legitimate domain like münchen.de becomes xn--mnchen-3ya.de. A homograph domain such as xn--metamsk-8zb.io will appear in your browser's address bar as the Punycode version if the browser detects mixed scripts. However, many browsers hide Punycode by default, showing only the decoded lookalike string. To check, you can manually convert the domain using an online Punycode converter or a browser extension.

3. Check the SSL Certificate Details

Click the padlock icon in your browser's address bar and view the certificate information. The certificate will show the actual registered domain name, including any Punycode. If the domain listed in the certificate differs from what you see in the address bar, it is a homograph attack.

4. Use a URL Inspection Tool

Services like URLScan.io or PhishTank allow you to paste a URL and see a screenshot of the site. Compare the domain visually in the screenshot to the address you entered. If the domain looks slightly off, it is likely a homograph.

5. Verify the Domain Using WHOIS

Check the domain's registration date and registrar. A recently registered domain that mimics a well-known crypto site is suspicious. This complements the already-covered method of checking domain age to spot phishing sites.

6. enable browser security features

Most modern browsers have built-in protections against homograph attacks. Keep your browser updated. Consider using browser extensions that flag mixed-script domains or show Punycode explicitly.

What browsers do to protect you

Browser vendors have implemented various defenses:

• Chrome and Firefox show Punycode for domains that mix scripts from different languages, but this is not foolproof. They may still display the decoded string if the domain uses only characters from a single script that happens to look like Latin.
• Safari historically showed Punycode for all IDNs, but recent versions have relaxed this to improve usability for legitimate non-English domains.
• Edge follows Chrome's approach.

The safest assumption is that no browser catches every homograph attack. Rely on manual verification.

Why homograph attacks persist

Domain registrars do not automatically block homograph domains. An attacker can register ethеrscan.io (with a Cyrillic "е") as long as it passes the registrar's basic checks. Some registrars have policies against "confusable" domains, but enforcement is inconsistent.

The attack is especially dangerous on mobile browsers, where the address bar is smaller and Punycode warnings are often hidden. Many crypto users access sites through wallet apps or mobile browsers, making them more vulnerable.

Practical steps to stay safe

• Always type the URL manually into your browser's address bar instead of clicking links from emails, social media, or search results.
• Bookmark trusted sites and use those bookmarks every time.
• Use a hardware wallet that requires physical confirmation for every transaction. Even if you connect to a fake site, a hardware wallet can prevent unauthorized transfers if you verify the transaction details on the device.
• Never rely on visual inspection alone when the URL contains unusual characters or accents.

Homograph attacks exploit a fundamental weakness in how humans read text. The only reliable defense is to verify the actual characters in the domain using tools that reveal the underlying code points. For crypto users, where a single wrong URL can empty a wallet, this verification step is not optional.

Back to phishing