A Homoglyph Attack is a form of cyber attack where attackers use characters that look alike from various alphabets or character sets to mislead users. This method is often seen in phishing, domain spoofing, and impersonation attacks.

How It Works:

• Attackers substitute letters in a real URL, username, or email with characters that appear similar.
  
  


• This deceives users into clicking harmful links or engaging with fake profiles.
  
  


• Numerous homoglyph attacks take advantage of Unicode characters, making them difficult to spot at first glance.
  

Look this: the Latin letter "O" (U+004F) and the Cyrillic letter "О" (U+041E) may look the same, but they are distinct characters encoded differently by computers...

Example of a Homoglyph Attack:

• Legit site: paypal.
  
  


• com Fake site: paypaI.
  
  


• com (The capital "I" replaces the lowercase "l") Another fake: рaypal.
  
  


• com (The "p" is actually a Cyrillic "р", not a Latin "p")
  

More Examples:

Is It Still Working in 2025?

Yes! Homoglyph attacks is still a serious threat in 2025.

• Phishing sites still use homoglyphs to deceive users.
  
  


• Social engineering attacks utilize fake usernames to impersonate trusted individuals.
  
  


• Email spoofing using homoglyphs still gets around some security filters.
  

How to Protect Yourself:

1. Verify URLs – Manually enter website addresses instead of clicking on unfamiliar links.
   
   


2. Enable MFA (Multi-Factor Authentication) – Even if your credentials are stolen, attackers can't log in.
   
   


3. Use Security Tools – Some modern browsers and email services identify homoglyph attacks.
   
   


4. Check SSL Certificates – Look for HTTPS and official domain registrations.
   

Generating a Domain Name with EvilURL for a Homoglyph Attack

I use EvilURL to generate homoglyph domain names and check if they are available for purchase to create a phishing ready website!

Step 1: Using EvilURL v3.0
Once installed, navigate to the EvilURL directory and run the following command in the terminal:

Code

python3 evilurl.py -g -d instagram.com

Copy the red domain name and check its availability for purchase, for example, on NameCheap.




Step 2: Enhancing Phishing Realism
To make the phishing attack more convincing, buy an SSL certificate and install it. This way, the URL will appear as https://instagram.com, making it look more legitimate.

Alternative Method: Online Generator
If EvilURL doesn’t work, you can use an online tool:
IronGeek Homoglyph Attack Generator

Enter the target domain name, and the tool will replace characters with similar-looking ones while keeping the domain appearance almost identical.

Step 3: Detecting Phishing Links with EvilURL
If you receive a suspicious message containing a link to sites like Facebook, Instagram, or YouTube, you can verify its legitimacy using EvilURL.

Copy the link and save it in a file (e.g., test.txt) inside the EvilURL directory.







Run the following command in the terminal:

Code

python3 evilurl.py -f /home/parrot/EvilURL/test.txt

EvilURL will analyze the link and highlight any altered characters.
Example: If the letter "s" in "instagram.com" is replaced with a similar looking character, EvilURL will detect the phishing attempt.

(Feb 10, 2025 11:04 AM)7 Wrote:  Great tutorial.
Also the use of subdomains is quite common

I owned the domains com-accountrecovery.app and net-accountrecovery.app too

Literally subdomain anything.com-accountrecovery.app

---

I didnt use them so no criminal charges brought to me from this, merely for demonstration purposes

(Feb 10, 2025 11:20 AM)Lowkey Wrote:  I've known about this but did not ever know what the name was called.

Neat!

(Feb 10, 2025 11:40 AM)Lowkey Wrote:  I triple check URL's and more in emails.

(Feb 10, 2025 01:32 PM)m0narch Wrote:  good small write up Jose! :P