Homograph domains are domain names that look like another legitimate domain by using visually similar characters from different writing systems. They are used in phishing and other impersonation attacks to deceive users and redirect traffic, often alongside lookalike subdomains, deceptive TLS certificates, and spoofed login pages.
How homograph domains work
Homograph domains exploit the way browsers, people and even some security tools display internationalised domain names. By substituting characters from different scripts that look alike, an attacker can register a domain that appears legitimate at a glance, even though it resolves to a completely different name and destination.
The technique is most effective when the target already expects a familiar brand, login portal or internal service. The deception does not depend on breaking DNS or TLS, it depends on visual confusion, hurried clicks and the assumption that a domain spelling is trustworthy because it looks right in the address bar or in a message link preview.
Why homograph domains are effective in phishing
Homograph domains are valuable to phishing operators because they compress several social-engineering layers into a single link. A lookalike domain can support a fake login flow, a spoofed support message, a password reset lure or a consent prompt that leads the victim to enter credentials, approve MFA, or download malware.
Defenders should treat the domain string as part of the impersonation chain, not a cosmetic detail. A convincing domain name can make a fraudulent site feel safe long enough for a victim to submit credentials, session tokens or other secrets, especially when the page also copies branding, certificates and page layout.
Common deception patterns and technical signals
Homograph abuse often appears with other indicators of impersonation, including lookalike subdomains, recently registered names, deceptive certificate use and cloned pages. The domain may differ by one character, use a different script, or blend Latin characters with visually similar characters from Cyrillic, Greek or other writing systems.
Because the attack is built on presentation rather than protocol failure, the strongest clues usually come from context. Typos, unusual language, mismatched brand ownership, unexpected redirects and login prompts that arrive outside normal workflow all matter. Security teams should also remember that a valid TLS certificate only proves control of the domain that was registered, not that the domain itself is trustworthy.
Defensive controls and user verification
Resisting homograph domains requires layered controls. Browser protections, secure email filtering, domain monitoring and brand protection help reduce exposure, but user verification remains important for high-risk actions such as credential entry, payment changes or administrative approvals. When a link matters, inspect the exact registrable domain rather than the displayed label.
For organisations, the most useful habits are to standardise trusted portals, reduce reliance on link-following for sensitive actions, and train users to verify domains before signing in. Security teams should also monitor for newly registered lookalikes and take down malicious domains quickly when brand impersonation is detected.
Risk and Threat Considerations
Homograph domains are dangerous because they exploit trust in appearance. The same visual confusion that deceives a user can also delay detection, especially when the attack is paired with a convincing login page or a credential-harvesting workflow.
Failure mechanism: The attacker registers a visually similar domain, uses it in email or messaging, and relies on the victim to enter credentials or approve access before suspicion arises.
Impact: Successful use can lead to account takeover, session theft, fraudulent transactions and broader impersonation of the targeted brand or service.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Homograph abuse is detected through monitoring for deceptive domains and suspicious access patterns. |
| SC-12 — Cryptographic Key Establishment and Management | TLS certificates can be used in deceptive homograph campaigns, so trust depends on proper certificate and key handling. | |
| AC-7 — Unsuccessful Logon Attempts | Phishing driven by homograph domains often precedes repeated login abuse and account compromise attempts. | |
| Recommendation — Monitor lookalike domains and suspicious login activity in SI-4 workflows. Validate certificate and key trust paths to avoid relying on deceptive TLS presentation. Correlate failed logons with suspicious domains to detect credential-stuffing follow-on activity. | ||
| CIS Controls v8 | CIS-9 — Email and Web Browser Protections | Homograph domains are commonly delivered through email and web links, making browser and email safeguards central. |
| Recommendation — Harden email and browser protections to reduce delivery and click-through of lookalike domains. | ||
| MITRE ATT&CK | T1566 — Phishing | Homograph domains are an impersonation technique used to support phishing delivery and credential theft. |
| Recommendation — Map suspicious lookalike-domain activity to T1566 and hunt for credential-harvesting infrastructure. | ||
Practitioner Guidance
What to watch for: Review the full domain name, not just the brand name rendered in a link preview or browser tab. Pay attention to script mixing, unexpected subdomains, unusual top-level domains and login prompts that arrive outside routine access patterns.
Governance implication: Organisations should define who owns lookalike-domain monitoring, how takedowns are requested, and what user-facing reporting path exists when a suspicious domain is seen. That ownership matters because homograph abuse is both a security and a brand-protection problem.
Related resources from NHI Mgmt Group
- How should security teams handle Punycode domains in email and web traffic without missing homograph attacks?
- What is the difference between blocking exfiltration domains and stopping NHI compromise?
- What breaks when RC4-only Kerberos accounts are migrated into AES-default Active Directory domains?
- Why do custom domains make OAuth callback governance harder?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org