Cyrillic Lookalikes Expose an Edge Case in Browser Address Checks

The Short Version

Research from Have I Been Squatted (HIBS) describes a Cyrillic-character combination that can evade layers of Chromium’s lookalike-domain checks, according to Tom’s Hardware. The example resembles Apple’s web address but is a different domain. The reported issue concerns how an address appears, rather than evidence that Apple’s website was compromised.

Why It Matters

Letters from different alphabets can look alike without being the same character. The report explains that Chromium sometimes displays a suspicious address in Punycode, an encoded form that makes the difference more apparent. Its example combining a Cyrillic letter with Latin letters triggers that protection.

The researchers’ all-Cyrillic example instead uses a character outside a particular lookalike-character list. That creates an edge case for the checks described, showing why an address that looks familiar deserves more scrutiny than visual resemblance alone.

The Bigger Picture

HIBS recommends that companies concerned about impersonation consider registering lookalike domains and encourage passkeys. The report explains that passkeys are tied to a specific domain, so they would not sign a user into the impersonating address.

Those recommendations address the impersonation risk. They do not establish that a specific phishing campaign is using this example.

What to Watch

The supplied account does not identify tested browser versions or establish the current patch status. Version-specific findings and any subsequent changes would help readers understand present exposure. The demonstration should not be read as proof that every current Chromium-based browser displays the example in the same way.

What helps you feel confident that a sign-in page belongs to the service you intended to visit?