Typosquatting and homoglyphs: how a single letter tricks your eyes
Last updated:
Typosquatting and homoglyph attacks represent the most sophisticated form of domain-level social engineering on the web. Scammers do not invent new names: they create exact visual clones with web addresses virtually indistinguishable from legitimate brands.
4 domain manipulation techniques
Attackers exploit human reading habits and font similarities to mislead even technical users.
Real-world deceptive domain examples
| Technique | Legitimate domain | Deceptive trap domain | How the trap works |
|---|---|---|---|
| Homoglyph I / l swap | paypal.com | paypaI.com | The final “l” is replaced by an uppercase “I” |
| Digit substitution | gouv.fr | g0uv.fr | The letter “o” is replaced by the number zero |
| Deceptive subdomain | laposte.fr | laposte.fr-tracking.info | The genuine brand name is placed in a subdomain prefix |
| High-risk TLD extension | ameli.fr | ameli.top | The brand name is correct but uses an obscure, cheap extension |
The risk of Internationalized Domain Names (IDN)
The IDN standard allows non-Latin characters in domain names. An attacker can register a domain such as “аррӏе.com” where all characters are Cyrillic. On screen, the text looks identical, but your browser is connecting to an entirely unrelated malicious server.
Actionable habits to protect yourself
- Always inspect the end of the domain name immediately before the first forward slash (the root domain).
- Avoid clicking unsolicited links in emails or messages: use saved bookmarks or search directly.
- Be skeptical of unusual extensions (.top, .buzz, .vip, .work) claiming to represent official public services or banks.
- Use a real-time browser protection tool capable of evaluating raw domain Punycode before you interact with the page.
How Resku detects deceptive domains
Resku runs lexical and phonetic analysis modules in the browser. The extension calculates Levenshtein distances, decodes Punycode, and compares visited domains against over 60 protected brands in ~200 ms.
Technical references
- ICANN : technical standards on Internationalized Domain Names and DNS security.
- ANSSI / CISA : corporate guidance on domain security and typosquatting defense.
- Cybermalveillance.gouv.fr : technical guides on lookalike domain attacks.
Frequently asked questions
What is typosquatting?
Typosquatting is a cyber attack technique where fraudsters register domain names that are slight misspellings of well-known brands (e.g. googel.com instead of google.com) or use alternate extensions to deceive users.
What is an IDN homoglyph attack?
A homoglyph attack uses visually identical characters from different alphabets (such as Cyrillic or Greek) or lookalike letters (like an uppercase “I” mimicking a lowercase “l”) to create fake domains that are virtually undetectable to the human eye.
Why can't the human eye reliably spot a homoglyph?
In standard modern system fonts, the Cyrillic “a” (U+0430) and the Latin “a” (U+0061) are rendered identically. Only automated tools that inspect the raw Punycode string can reliably detect the manipulation.
How do security tools and browsers handle lookalike domains?
While browsers display a technical “xn--” prefix for some mixed-script domains, attackers constantly adapt to bypass basic filters. Resku compares every visited domain against a database of over 60 protected brands in real time.
A single invisible character swap is enough to steal your credentials. Resku inspects domain strings in ~200 ms and compares addresses against over 60 monitored brands.
Join the waitlist