Homoglyph
A homoglyph is a character that looks like another one (Cyrillic а and Latin a, or rn and m), and phishing domains use homoglyphs to imitate a brand's real domain.
How it works
Internationalised domain names allow letters from many scripts, so a domain can be visually identical to a real one while being a different name. Simpler variants rely on similar letter pairs such as rn/m, vv/w or l/1.
Browsers show the Unicode form in some cases and the punycode form (xn--) in others, depending on the scripts mixed.
Example from the PhishDestroy database
- xn--mrkng10059-zub.com: Internationalised (punycode) phishing domain, first detected 2026-10-16.
- xn--btrefll-rfbe.com: Internationalised (punycode) phishing domain, first detected 2026-10-15.
- xn--pay-bitefill-ljc.com: Internationalised (punycode) phishing domain, first detected 2026-10-15.
How to protect yourself
- Open important sites from bookmarks rather than links.
- Paste a suspicious domain into a homoglyph checker to see every character and its script.