Unicode Vulnerabilities
When the IETF decided to allow Unicode characters in domain names, many techies saw the move as commendable, but also fraught with danger, as hundreds of unique characters can look similar or identical across multiple alphabets. This can be used for typosquatting attacks, wherein bad actors create functioning websites with deliberately misspelled web addresses that look identical to the real URL, thus launching attacks against unsuspecting visitors who land on the site due to search results generated when the user mistypes an address. The Chromium browser has the most advanced ruleset for finding and preventing mischievous domains masquerading as legitimate ones, but even the best code has odd edge cases, as a blog post from Have I Been Squatted (HIBS) explains in great detail.
Using an example with Cyrillic lookalikes, researchers show how specific combinations of characters can still evade multiple layers of protection, thanks to the particular circumstances surrounding the use of specific Cyrillic characters. This alphabet has lookalikes for many Latin letters, making visual detection difficult.
Trying to sneak one homoglyph into the middle of standard Latin ones triggers Chromium's safeguards and makes the browser display the domain name in its Punycode format. With few exceptions, domain names with non-Latin characters ending in .com only pass the check if they're all from the same alphabet.
Defensive Measures and Limitations
Chromium keeps a list of Cyrillic characters that routinely masquerade as their Latin counterparts, and composing a domain name using only characters from that list is restricted.
Certain character variations can still bypass filters if specific letters are not included in restricted detection lists.
Character Discrepancies and Corner Cases
While newer releases of browsers can update their blocklists, this reveals the difficulty of the problem: since there's no one-size-fits-all solution for detecting typo-squatting, even the best set of rules will sooner or later end up on the wrong side of a corner case.
Monitoring Unicode is challenging given that the character set continually evolves and now counts nearly 173,000 entries, though only a subset of those are eligible to be used as domain names or TLDs in practice.
Chromium is reportedly the best browser at detecting domain lookalikes, as a previous study showed that it caught the vast majority of attempts, with other browsers trailing behind. Chromium underpins the Chrome, Edge, and Brave browsers.
Besides many other rules and per-alphabet verifications, Chromium keeps a list of popular domains bound to be typo-squatted and runs stronger checks against them. Domain registries, likewise, make reasonable efforts to prevent typo-squatting, like having strict rules about what characters can go into which TLDs, but that's not nearly enough to fully solve the problem.
All things considered, security researchers recommend that companies afraid of impersonation try to register any lookalike domains and encourage passkey use by users. Passkeys are always tied to a specific domain, so a user wouldn't be able to log in to a fraudulent website with them.
