GoKawiilSecurity researchers find Cyrillic domain spoof that bypasses Chromium's anti-phishing check
Researchers at Have I Been Squatted demonstrated that a domain written as 'аррӏө.com,' using Cyrillic lookalike characters, can evade Chromium's safeguards against deceptive Unicode domains even though it visually mimics apple.com. Chromium normally flags mixed-script domains by converting them to Punycode, and blocks domains built entirely from its list of 29 known Cyrillic lookalike characters, but this specific character combination slips through both checks.