{"id":5621,"date":"2026-05-21T14:35:13","date_gmt":"2026-05-21T14:35:13","guid":{"rendered":"https:\/\/adex.com\/blog\/?p=5621"},"modified":"2026-05-21T14:35:14","modified_gmt":"2026-05-21T14:35:14","slug":"homograph-attack-fake-urls","status":"publish","type":"post","link":"https:\/\/adex.com\/blog\/homograph-attack-fake-urls\/","title":{"rendered":"Homograph Attacks: When URLs Look Identical but Aren’t"},"content":{"rendered":"\n

A user types paypal.com<\/em><\/strong> into the address bar. The site loads. The padlock is green. The TLS certificate is valid. The branding is correct. And the credentials they enter go straight to an attacker, because the domain wasn’t paypal.com<\/em><\/strong>. It was p\u0430ypal.com<\/em><\/strong>, with a Cyrillic “\u0430” in place of the Latin one. To the eye, identical. To DNS, a completely different domain.<\/p>\n\n\n\n

This is a homograph attack, and it’s one of the few impersonation techniques that exploit a flaw in human perception rather than a software flaw. It doesn’t depend on tricking distracted users into misreading a URL. Even a careful person, looking directly at the address bar, sees the brand they expect.<\/p>\n\n\n\n

For adtech, affiliate operations, and brand teams, the relevance is direct. Homograph and look-alike domains increasingly impersonate networks, advertisers, and publishers in phishing, ad-fraud landing infrastructure, and reputation attacks. <\/p>\n\n\n\n

What follows is the mechanism itself, where defenses break, and how to think about exposure operationally rather than theoretically.<\/p>\n\n\n

Contents<\/h4>