Typo-Squatting and Cyrillic Edge Cases Evade Security
Security research highlights ongoing challenges with domain typo-squatting as specific Cyrillic character edge cases manage to bypass leading browser safeguards.
Radwan AbdulhadiEditor and technology writer
The Persistent Threat of Unicode Typo-Squatting
When the Internet Engineering Task Force (IETF) decided to permit Unicode characters within domain names, technologists recognized both the innovation and the inherent dangers. Hundreds of distinct characters can appear similar or identical across multiple alphabets, opening the door for typo-squatting attacks. As detailed in a report by <a href="https://www.tomshardware.com/tech-industry/cyber-security/typo-squatting-attacks-with-major-domains-are-still-viable-corner-cases-with-crying-characters-still-evade-the-best-checks">Tom's Hardware</a>, malicious actors construct functioning websites with deliberately misspelled addresses that mimic legitimate URLs. Unsuspecting visitors land on these sites after making typographical errors or through misleading search results. Further details are available from Tom's Hardware in the original source material.
Although modern browsers incorporate robust defenses to spot malicious domains, complex edge cases continue to challenge the best security software. A recent blog post from Have I Been Squatted (HIBS) <a href="https://haveibeensquatted.com/blog/turning-idn-edge-cases-into-typosquats">explains in great detail</a> how specific character combinations manage to slip past sophisticated filters.
Cyrillic Homoglyphs and Browser Safeguards
The Cyrillic alphabet frequently serves as a source for homoglyphs because it contains lookalikes for numerous Latin letters. For instance, the Cyrillic characters а, е, о, р, and с closely resemble their Latin counterparts a, e, o, p, and c. When a threat actor attempts to embed a single homoglyph within standard Latin characters, it generally triggers browser safeguards.
Chromium, which underpins popular software such as Chrome, Edge, and Brave, responds to such mixed-alphabet attempts by rendering the domain name in its <a href="https://www.punycoder.com/">Punycode</a> format. With few exceptions, domain names utilizing non-Latin characters and ending in .com will only pass verification checks if all characters originate from the same alphabet.
Bypassing Defenses Through Edge Cases
Even restricting a domain to all-Cyrillic lookalikes does not guarantee a successful spoofing attempt, as Chromium maintains a designated blocklist of 29 Cyrillic characters that frequently masquerade as Latin letters. Constructing a domain entirely from characters on this restricted list is automatically flagged and blocked.
However, security researchers demonstrated that domains can still slip through by utilizing clever corner cases. For example, using a character like "ө"—which is not currently featured on Chromium's special list of 29 restricted characters—allows the crafted domain to bypass current security rules. While future software releases will likely add such characters, this vulnerability highlights the fundamental difficulty of engineering a one-size-fits-all detection system.
The Evolution of Character Sets and Detection Limitations
Managing character safety has become increasingly difficult as the Unicode standard continually expands, now encompassing nearly 173,000 entries, though only a subset are legally eligible for use as domain names or top-level domains. Beyond per-alphabet verifications and general rules, Chromium maintains an internal database of over 8,000 popular domains prone to typo-squatting, running rigorous checks against a critical subset of 836 high-target domains.
Domain registries also enforce various restrictions, such as strict rules governing permissible characters within specific top-level domains. Nevertheless, these collective industry measures remain insufficient to completely eradicate the threat of sophisticated typo-squatting.
Recommended Mitigation Strategies
To mitigate the ongoing risks posed by domain impersonation, security researchers at HIBS recommend that vulnerable organizations proactively register common lookalike domains. Furthermore, companies are encouraged to implement passkeys for user authentication. Because passkeys are strictly bound to a specific, legitimate domain, users are entirely protected from inadvertently logging into fraudulent or spoofed websites.
Sources
- Tom's HardwareTypo-squatting attacks with major domains are still viable
Continue chronologically
Related stories
Tom's Hardware Details Vera CPUs and Agentic AI Benchmarks
Explore the latest Tom's Hardware coverage including Nvidia Vera CPUs on Oracle clusters, agentic AI benchmarks, and LLM primers.
Deepseek Unveils V4.1 Flash 1017 AI Model
Deepseek has upgraded its V4.1 Flash open-weight AI model, delivering lower running costs and high efficiency alongside notable hallucination challenges.
Chip Fab Engineering Game Goes Viral in Taiwan
A new 3D web-based simulation game depicting life as a semiconductor wafer factory worker has gone viral in Taiwan, drawing mixed reviews for its stress.
Nvidia GPU Prices Spike in Japan, Surpassing US Rates
Nvidia RTX 50-series GPU prices have surged at a Japanese retailer, showing significant markups compared to Amazon US listings amid supply pressures.
