Typo patterns / 02
Homoglyphs
Characters that look the same but aren't. Nobody mistypes these: they're registered on purpose and sent in links, where they pass a quick glance.
You meant
example.com
You typed
examp1e.comWhat they are
A homoglyph is a character that looks like another one. Some pairs live on every keyboard: the digit 0 and the letter o, or rn and m set close together. Others come from different alphabets entirely: Cyrillic has letters drawn exactly like Latin a, e, o, p and more.
Unlike the other patterns, these aren't typos. Someone registers the look-alike and sends it to you: in an email, a text message, an ad. The link reads as your name, so people click it.
example.com
examp1e.com“l” looks like “1”
microsoft.com
rnicrosoft.com“m” looks like “rn”
google.com
g0ogle.com“o” looks like “0”
Look-alikes on any keyboard
Shown in a sans-serif face, the way an address bar or email client shows them.
rnm
rn looks like mEasy to misso0
o looks like 0Easy to miss0o
0 looks like oEasy to missl1
l looks like 1Easy to miss1l
1 looks like lEasy to missvvw
vv looks like wEasy to missli
l looks like iEasy to missil
i looks like lEasy to missi1
i looks like 1Easy to miss1i
1 looks like iEasy to misscld
cl looks like dEasy to missnnm
nn looks like mCloser lookgq
g looks like qCloser lookqg
q looks like gCloser lookuv
u looks like vCloser lookvu
v looks like uCloser looke3
e looks like 3Closer looks5
s looks like 5Closer looka4
a looks like 4Closer lookg9
g looks like 9Closer lookb6
b looks like 6Closer look
Other alphabets
Each pair below is a Latin letter and a Cyrillic one. They render the same; the code points show they're different.
aа
U+0061
Latin a and Cyrillic а look the same but are different characters.
U+0430cс
U+0063
Latin c and Cyrillic с look the same but are different characters.
U+0441dԁ
U+0064
Latin d and Cyrillic ԁ look the same but are different characters.
U+0501eе
U+0065
Latin e and Cyrillic е look the same but are different characters.
U+0435hһ
U+0068
Latin h and Cyrillic һ look the same but are different characters.
U+04BBiі
U+0069
Latin i and Cyrillic і look the same but are different characters.
U+0456jј
U+006A
Latin j and Cyrillic ј look the same but are different characters.
U+0458lӏ
U+006C
Latin l and Cyrillic ӏ look the same but are different characters.
U+04CFoо
U+006F
Latin o and Cyrillic о look the same but are different characters.
U+043Epр
U+0070
Latin p and Cyrillic р look the same but are different characters.
U+0440qԛ
U+0071
Latin q and Cyrillic ԛ look the same but are different characters.
U+051Bsѕ
U+0073
Latin s and Cyrillic ѕ look the same but are different characters.
U+0455wԝ
U+0077
Latin w and Cyrillic ԝ look the same but are different characters.
U+051Dxх
U+0078
Latin x and Cyrillic х look the same but are different characters.
U+0445yу
U+0079
Latin y and Cyrillic у look the same but are different characters.
U+0443
Most registries won't register a name that mixes alphabets, and browsers display mixed names as punycode. So the dangerous case is a name where every letter has a look-alike in one other alphabet. TypoScan only generates those whole-alphabet swaps.
Punycode
DNS only understands ASCII letters, digits and hyphens. Names in other scripts are stored in an ASCII encoding called punycode, which starts with xn--. The fake аррӏе.com above is really xn--80ak6aa92e.com.
Browsers decide whether to show the Unicode form or the punycode form. Most show punycode when a name mixes scripts, and some also when it imitates a well-known domain, which defeats many of these attacks in the address bar. Email clients, chat apps and printed links are less consistent, which is where look-alikes still work.
If a link's address shows xn-- where you expected a familiar name, treat it as fake.
Try it
Type any domain to see its look-alikes.
- app1e.comLook-alike · “l” looks like “1”High likelihood, 76
- аррӏе.comOther alphabet · Every letter swapped for a Cyrillic look-alikeMedium likelihood, 74
- appie.comLook-alike · “l” looks like “i”Medium likelihood, 72
- appl3.comLook-alike · “e” looks like “3”Medium likelihood, 52
- 4pple.comLook-alike · “a” looks like “4”Low likelihood, 48
- No more lookalikes of this kind for apple.com.
See these on your own domain
Every pattern, scored and checked for registration, in one scan.