GoKawiilSecurity researchers find Cyrillic domain spoof that bypasses Chromium's anti-phishing check
Researchers at Have I Been Squatted demonstrated that a domain written as 'аррӏө.com,' using Cyrillic lookalike characters, can evade Chromium's safeguards against deceptive Unicode domains even though it visually mimics apple.com. Chromium normally flags mixed-script domains by converting them to Punycode, and blocks domains built entirely from its list of 29 known Cyrillic lookalike characters, but this specific character combination slips through both checks.
GoKawiil's interpretation of the reporting above, not reported fact.
The finding suggests that even the most advanced anti-spoofing ruleset among major browsers has gaps that attackers could exploit for typosquatting and phishing campaigns against well-known brands. It highlights an ongoing tension between supporting international Unicode domain names and preventing visually deceptive lookalike URLs, a problem that may require browser vendors to continually update detection rules as new character combinations are discovered.
- A Cyrillic variant of 'apple.com' bypassed Chromium's Punycode and lookalike-character safeguards, per researchers at Have I Been Squatted.
- Chromium blocks domains mixing scripts or built entirely from a list of 29 known Cyrillic lookalikes, but this combination avoided both triggers.
- The discovery points to ongoing weaknesses in homoglyph-based typosquatting defenses despite Chromium having the most advanced detection rules among browsers.
YubiKey 5 NFC Security Key — Typosquatting attacks often aim to steal login credentials via lookalike domains, and a hardware security key like the YubiKey 5 NFC stops that cold since it verifies the actual site origin before authenticating. It's a simple, durable way to protect your accounts even if you accidentally land on a cleverly disguised phishing page.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: tomshardware.com — Bruno Ferreira, 2026-10-18
Published there as: “Typo-squatting attacks with major domains are still viable”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.