🔤 Homograph Domains

Homograph attacks use Unicode characters that look similar to Latin letters but are from different scripts (Cyrillic, Greek, Armenian). Examples:

• example.com → еxample.com (Cyrillic 'е' instead of Latin 'e')
• google.com → gooogle.com (extra 'o')
• facebook.com → faceboook.com (extra 'o')
• microsoft.com → microsft.com (missing 'o')
• amazon.com → amzaon.com (swapped 'a' and 'o')
• paypal.com → рaypal.com (Cyrillic 'р' instead of Latin 'p')

Risk Level: High - These domains can be visually identical to legitimate domains.

🌐 Alternative TLD Domains

These variants use the same second-level domain but with different top-level domains:

• example.com → example.net, example.org, example.io
• Includes popular gTLDs, country codes, and high-risk TLDs
• Special attention to suspicious TLDs like .tk, .ml, .ga frequently used in scams

Risk Level: Medium to High - Depends on TLD reputation and usage patterns.

⌨️ Typosquatting Domains

Domains that exploit common typing mistakes:

• Character Omission: example.com → exampe.com
• Character Insertion: example.com → exaample.com
• Character Substitution: example.com → exzmple.com (keyboard proximity)
• Character Swap: example.com → exmaple.com
• Character Duplication: example.com → exxample.com

Risk Level: Medium - Common user errors make these effective for phishing.

Each detected variant is assigned a risk score (0-100) based on:

• Detection Type: Homographs score highest, followed by suspicious TLDs
• Domain Length: Shorter domains receive higher risk scores
• TLD Reputation: Known malicious TLDs increase the score
• Script Mixing: Domains mixing multiple character scripts are flagged as higher risk

• Regular Monitoring: Run detection monthly or when launching new campaigns
• Domain Registration: Consider registering high-risk variants proactively
• DNS Monitoring: Set up alerts for domain registrations similar to yours
• User Education: Train users to verify URLs carefully, especially for sensitive actions
• Email Security: Implement DMARC, SPF, and DKIM to prevent email impersonation