# Homoglyph

A homoglyph is a character that looks like another one (Cyrillic а and Latin a, or rn and m), and phishing domains use homoglyphs to imitate a brand's real domain.

## How it works

Internationalised domain names allow letters from many scripts, so a domain can be visually identical to a real one while being a different name. Simpler variants rely on similar letter pairs such as rn/m, vv/w or l/1.

Browsers show the Unicode form in some cases and the punycode form (xn--) in others, depending on the scripts mixed.

## Example from the PhishDestroy database

- [xn--mrkng10059-zub.com](https://phishdestroy.io/domain/xn--mrkng10059-zub.com/): Internationalised (punycode) phishing domain, first detected 2026-10-16.
- [xn--btrefll-rfbe.com](https://phishdestroy.io/domain/xn--btrefll-rfbe.com/): Internationalised (punycode) phishing domain, first detected 2026-10-15.
- [xn--pay-bitefill-ljc.com](https://phishdestroy.io/domain/xn--pay-bitefill-ljc.com/): Internationalised (punycode) phishing domain, first detected 2026-10-15.

## How to protect yourself

- Open important sites from bookmarks rather than links.
- Paste a suspicious domain into a homoglyph checker to see every character and its script.

## Related tools

- [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker)
- [Invisible Character Detector](https://phishdestroy.io/developer-tools/invisible-char-detector)
- [Lookalike Domain Generator](https://phishdestroy.io/developer-tools/lookalike-generator)

## Related terms

- [Punycode](https://phishdestroy.io/glossary/punycode/)
- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)

## Further reading

- [Newly Registered Domains: Phishing Risk Guide](https://phishdestroy.io/newly-registered-phishing-domains)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/homoglyph/