Why Are Homoglyph Domains So Effective?
A homoglyph uses characters that render identically, or nearly, to the real ones, so a malicious domain looks correct to a human and is a different value to a computer. This video starts with a simple lookalike on a checkout (a zero for the o), explains why careful review can never catch the Unicode version, how it differs from a typosquat, the three ways it shows up against scripts and allowlists, and the five defences that compare by value instead of appearance.
Full answer: Homoglyph Attacks: When a Domain Is Not the Domain
Transcript
Homoglyph domains work because they use characters that look identical to the real ones, so the domain passes human review. There's nothing to see. To a person it reads correctly. To a computer, it's a different domain. Start with the simplest version. A script on northwind.com's checkout loads from northwind.com with a zero for the o. Skimming the page source, it reads as the store's own domain. A zero for an o is the easy case. Unicode goes further. In most fonts, a Cyrillic small a looks exactly like a Latin one. They're different code points, so they're different domains, filenames and allowlist entries. Reviewing a domain by looking at it compares rendered glyphs, and that's exactly what the attack makes identical. Reading more carefully doesn't help. Asking a colleague to double-check doesn't either. That's what separates it from a typosquat. A typosquat needs someone to mistype, and the domain looks different. A homoglyph looks identical, so the victim doesn't have to make any mistake at all. Against scripts, it shows up three ways. A script loaded from a domain that looks like a CDN you trust. An allowlist entry in your CSP or tag configuration that looks approved and isn't. And package or file names that read as correct. Why do attackers bother? Because a lookalike origin makes injected code look routine to anyone reviewing the page. It's most common in phishing, and it shows up in script supply chain attacks, behind a lookalike CDN domain. The defence isn't looking harder. It's comparing by value, not appearance. Pin the payload hash, so a script from a lookalike domain is a payload you never approved. Flag mixed-script names, show Punycode, and treat every new origin as new. And if you find one in your script origins or your CSP, treat it as an incident. It isn't an accident. Preserve the evidence, find when it was added and by whom, and check what loaded from it. Script Monitoring fingerprints every script it sees in real sessions, so a payload you never approved comes to you for review. It's free for 1,000 page views a month, and Pro starts at $99 a month. Start for free at scriptmonitoring.com.