All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
Typosquatting has long been a method scammers use to trick people into visiting fake websites that imitate legitimate ones. It involves using misspelled or lookalike domain names.
You land on what you believe to be a genuine shopping website or your bank’s portal, enter your credentials, and unknowingly hand them over to scammers. They could then use your login details to access your accounts, steal your personal information, or even drain your bank account.
Browsers have introduced safeguards to detect these deceptive domains, but researchers Ian Muscat and Leanne Briffa of Have I Been Squatted have now found that attackers can use two unusual characters to create lookalike domains that bypass key safeguards in Chrome and other Chromium-based browsers.[1]
Here’s how the trick works and what you can do to protect yourself.
Scammers want you to visit a fake website that looks like a genuine one. For instance, you might accidentally visit applle.com instead of apple.com.
To get around this, attackers can use letters from other alphabets that look almost identical to English characters. Russian Cyrillic, for example, contains several letters that resemble Latin characters, such as a, p, e, and o. Although they look similar, computers treat them as different characters.
According to Muscat and Briffa, two characters are particularly useful for bypassing browser safeguards: ө, found in languages such as Kazakh, Mongolian, and Tatar, and ƙ, a Latin letter with a hook used in Hausa and Karai-karai. These characters allow attackers to register deceptive domains such as oƙta.com instead of okta.com and niƙe.com instead of nike.com.
Browsers such as Chrome have safeguards designed to detect these tricks and display suspicious domains in a way that helps users spot the difference. However, the researchers found ways around several of these defenses.
In 2017, a researcher registered a fake Apple.com website using only Cyrillic letters. After this, browsers introduced a rule: if every letter in the domain name is Cyrillic and belongs to a known list of characters that look like English letters, the browser treats the domain as suspicious and displays it in its encoded form.
However, this rule is all or nothing. Even if one letter falls outside the predefined list, the check may not flag the domain. For example, researchers found that replacing the final е in the all-Cyrillic domain аррӏе.com with ө creates аррӏө.com, which can bypass this first guardrail because ө is not on Chromium’s Cyrillic lookalike list.
Chromium browsers maintain a list of 8,000+ popular domains. They simplify suspicious website addresses by stripping accents and converting lookalike characters into their English equivalents. If the resulting form matches a website on the list, the browser displays the address in its encoded Punycode form, which begins with xn--.
However, this guardrail also has a flaw. It strips accents before converting lookalike characters. Some characters, such as ƙ, have their hooks built in rather than added as an accent. When Chromium converts ƙ into k, the hook can remain as a separate mark.
/images/2026/10/12/typosquatting-bypass-chromium-defenses_01.png)
As a result, oƙta.com does not reduce to an exact match for okta.com. The browser may therefore display oƙta.com in Unicode rather than its encoded form, leaving users without that potential warning.
As another line of defense, Chrome can display a warning when you visit a website that closely resembles a popular domain or one you visit frequently. Depending on the match, this can take the form of a full-page warning or a smaller safety tip next to the address bar.
/images/2026/10/12/typosquatting-bypass-chromium-defenses_02.png)
However, this safeguard also has limitations. Chrome checks for exact matches, single-character changes, and swaps between adjacent characters. It can miss domains that differ by two or more changes. It also skips near-match checks for domains with fewer than five characters before the top-level domain.
For example, the researchers found that аррӏө.com differs from Apple.com by two character changes after simplification, so it can evade the warning.
If you land on a fake website, you might inadvertently enter your username and password, allowing attackers to steal your credentials. They could also capture your two-factor authentication codes as you enter them and use the credentials and codes to authenticate a legitimate session from their own device.
This could be particularly damaging when visiting banking portals or social media websites, potentially allowing attackers to commit financial fraud or take over your accounts. Other threats include phishing scams and identity theft.
The use of letters from other alphabets has made the age-old advice to “check the address bar” less reliable. It can be difficult for the average user to notice whether a website is genuine or spot a lookalike character replacing a letter in a familiar domain.
Here are a few steps you can take when visiting websites.
Typosquatting has evolved beyond obvious misspellings. Attackers can now use lookalike characters from other alphabets to create deceptive websites that bypass certain browser safeguards and trick users into handing over sensitive information.
A successful attack could lead to stolen credentials, compromised accounts, financial fraud, or identity theft. Browser protections remain useful, but they’re not foolproof, so be careful when visiting unfamiliar websites and verify the address before sharing sensitive information.
Credit monitoring service with 3-bureau scores updated monthly and a breakdown of what's affecting your score
Data removal covers 425+ broker sites, plus a digital account cleanup that flags risky accounts in your inbox
Identity theft insurance up to $1M for individuals, with 24/7 phone and email support
/images/2023/12/01/omniwatch_review.jpg)
/images/2023/10/12/best_identity_theft_protection_with_dark_web_monitoring.jpg)
/images/2026/10/12/two_characters_can_sneak_fake_domains_past_your_browsers_defenses_1.png)
/images/2026/10/12/police_do_not_cross_tape_at_night_in_downtown_philadelphia.jpg)
/images/2026/10/09/age-verification-checks-survey.png)
/images/2026/10/08/claude-chat-arrest-florida-woman.jpeg)
/images/2026/10/08/california-sb-690-online-tracking-lawsuits.png){kind=tracking}
/images/2026/10/07/trump-mobile-data-breach.jpeg)
/authors/krishi_chowdhary_headshot.jpg){kind=small}
/authors/thomas-kent-headshot-cropped.png){kind=small}
/images/2024/05/17/7249df62-b35e-4ac5-bfc4-0e28a6a30b9e.png)
/authors/krishi_chowdhary_headshot.jpg)