Homograph domains still fool users — hygiene that actually catches them

A domain that looks exactly like a familiar brand's URL can still be fake. Internationalized domain names allow characters from Cyrillic, Greek and other scripts that render identically to Latin letters — swap enough of them into a brand's name, register the result, and a browser can display something that looks like the real address while pointing somewhere else entirely. This is the IDN homograph attack, and it remains one of the harder phishing techniques for users to catch on sight.

Why "read the URL carefully" is not enough

Advice to inspect a URL before logging in assumes a user can visually tell the difference between characters that were specifically chosen to look the same. They often cannot. That is why the more durable defenses do not depend on human perception at all.

Defenses that do not rely on users spotting the swap

• Password managers only autofill credentials on the exact domain string they were saved against, not on whatever a domain visually resembles — this alone blocks most credential theft from a homograph page.
• DNS-level filtering can block known lookalike domains before a user's browser ever loads them.
• Certificate Transparency monitoring flags new certificates issued for brand-lookalike domains, often before a phishing page goes live.
• Browsers can be configured to render suspicious internationalized domains in their raw Punycode form instead of the deceptive script.
• Registering the most obvious homoglyph variants of a company's own domain removes some of the easiest targets for an attacker.

What helpdesks should actually tell users

Bookmark sensitive login pages after a verified first visit rather than typing or clicking a link each time. Escalate any lookalike of the organization's own brand to whoever owns abuse or brand-protection reporting. And never ask a user to "test" a login page someone else sent them — that instruction alone defeats most of the technical defenses above.

No browser today reliably blocks every homograph domain on its own, so the practical takeaway is defense in depth: technical controls that do not depend on perception, plus enough user awareness to escalate what does get through.

Sources: Wikipedia, zvelo.