{
  "id": 15404490,
  "title": "Typo-squatting attacks with major domains are still viable",
  "url": "https://urgent.news/2026/10/18/typo-squatting-attacks-with-major-domains-are-still-viable",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-18T12:05:00.000Z",
  "source": {
    "name": "Tom's Hardware",
    "slug": "tom-s-hardware",
    "url": "https://www.tomshardware.com/tech-industry/cyber-security/typo-squatting-attacks-with-major-domains-are-still-viable-corner-cases-with-cyrillic-characters-still-evade-the-best-checks"
  },
  "original_language": "en",
  "account": "When the IETF permitted Unicode characters in domain names, many tech enthusiasts recognized the commendable move while also acknowledging the potential dangers, given the vast number of unique characters that can appear similar or identical across various alphabets. This scenario can be exploited for typosquatting attacks, where malicious actors craft websites with deliberately misspelled web addresses that resemble legitimate URLs. Consequently, unsuspecting users who stumble upon such sites via search results generated by mistyped addresses become victims of these attacks. The Chromium browser boasts the most sophisticated set of rules for identifying and thwarting deceptive domains masquerading as genuine ones. Nonetheless, even the most robust code is prone to occasional oversights, as demonstrated by a blog post from Have I Been Squatted (HIBS). The researchers provided a detailed case study using аррӏө.com, which is not the same as the actual apple.com, to illustrate how certain character combinations can bypass multiple layers of protection due to specific characteristics of the Cyrillic alphabet. The Cyrillic alphabet shares lookalikes for many Latin letters, such as а → a, е → e, о → o, р → p, and с → c. Though Chromium's safeguards typically detect such homoglyphs, causing the browser to display the domain name in Punycode format, for instance, а → xn--pple-43d.com. However, attempting to use all Cyrillic lookalikes, like аррӏе.com, would also fail. Chromium maintains a list of 29 Cyrillic characters that commonly imitate their Latin counterparts, and constructing a domain name using exclusively from this list is prohibited. Interestingly, the pesky ө character, which is not on that list, allows аррӏө.com to slip through. While newer Chromium releases likely include this character, this instance highlights the challenge of detecting typo-squatting: there is no universal solution, and even the most comprehensive set of rules will eventually stumble upon an exception. The ever-evolving character set, now comprising approximately 173,000 entries, only a subset of which are suitable for domain names or TLDs, only exacerbates the issue. Chromium is reportedly the most adept browser at detecting domain lookalikes, as indicated by a 2020 study which found it caught 64.1% of the attempts, trailing behind Firefox and Safari. It's worth noting that Chromium powers Chrome, Edge, and Brave browsers. In addition to various other rules and alphabet-specific checks, Chromium maintains a list of over 8,000 popular domains prone to typo-squatting and applies stronger scrutiny to 836 of them. Domain registries also endeavor to prevent typo-squatting by implementing strict rules about which characters can be used in specific TLDs, but this alone is insufficient to fully address the problem. In conclusion, HIBS advises companies concerned about impersonation to register potential lookalike domains and encourage the use of passkeys, which are always linked to a specific domain and thus would prevent users from inadvertently logging into a deceptive website.",
  "summary": "Typo-squatting attacks with major domains are still viable — corner cases with Cyrillic characters still evade the best checks",
  "key_points": [
    "Typo-squatting attacks exploit Unicode characters in domain names",
    "Chromium browser has most sophisticated rules for detecting deceptive domains",
    "Have I Been Squatted case study shows аррӏө.com bypasses protections"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}