Skip to main content
Detect and block Internationalized Domain Name (IDN) homograph attacks where attackers use visually similar characters from different scripts (Cyrillic, Greek, etc.) to impersonate legitimate domains and enable phishing attacks.

​
Why Homograph Detection Matters

The threat: Attackers register domains that look identical to legitimate sites by using Unicode characters from different alphabets. For example:
  • apple.com (legitimate) vs аpple.com (Cyrillic ‘а’)
  • paypal.com (legitimate) vs pаypаl.com (Cyrillic characters)
Business impact:
  • Credential theft (users enter passwords on fake login pages)
  • Financial fraud (fake banking/payment sites)
  • Brand impersonation (trust exploitation)
  • Phishing campaigns bypass traditional URL filters
How it works: Browsers display internationalized domain names (IDN) using Unicode, making it nearly impossible for users to distinguish malicious lookalikes from legitimate domains.

​
When to Use Homograph Detection

:::tip Combine with Other Defenses Homograph detection works best alongside DNSBL (block known-bad domains), SSL Inspection (detect fake certificates), and user security awareness training. :::

​
Prerequisites

​
Configuration Steps

  1. Access Configuration Portal
    Navigate to Real Time Content Security → DNS Blacklist     Homograph Configuration
  2. Enable Homograph Detection
    • Enabled: Set to TRUE
    • Save the configuration
  3. Apply Changes
    Click Apply to activate the new policy.
:::note Feature Location Homograph Detection is configured in the DNS Blacklist section because it operates at the DNS resolution layer, intercepting suspicious domain patterns before connection. :::

​
Verification

Test that Homograph Detection is blocking IDN attack attempts:

​
Method 1: Command-Line Test (cURL)

Expected result: SafeSquid blocks the request and displays a block page. Note: The URL http://аpple.com uses a Cyrillic ‘а’ (U+0430) instead of the Latin ‘a’ (U+0061). cURL Verification Output

​
Method 2: Browser Test

  1. Configure your browser to use SafeSquid as proxy (see Connect Your Client)
  2. Navigate to http://аpple.com
  3. Expected result: SafeSquid displays a block page
Browser Verification Output

​
Method 3: Log Verification

Check SafeSquid logs for blocked homograph attempts:
Expected entries: Logs should show blocked requests with reason=homograph or similar indicators.

​
Troubleshooting

Still having issues? Contact SafeSquid support with:
  • Screenshot of Homograph Detection configuration
  • Sample blocked domain attempts
  • Contents of /var/log/safesquid/safesquid.log and /var/log/safesquid/security.log

​
How Homograph Detection Works

SafeSquid analyzes domain names during DNS resolution and checks for:
  1. Mixed scripts: Domains using characters from multiple alphabets (e.g., Latin + Cyrillic)
  2. Lookalike patterns: Visual similarity to known legitimate domains
  3. Suspicious Unicode: Non-ASCII characters in domain names
When detected, SafeSquid blocks the request and logs the attempt for audit trails.

​
Source register

​
Next Steps

  • Layer defenses: Combine with DNSBL to block known-malicious domains
  • Inspect certificates: Enable SSL Inspection to detect fake TLS certificates on lookalike domains
  • Monitor attempts: Use Security Logs and Reporting to track homograph attack patterns
  • User training: Educate users about IDN attacks and visual domain verification

Related topics

DNS SecurityIntegrated DNS SecurityThreat Intelligence FeedsDNS blacklistCompliance Templates