Typosquatting remains a viable attack vector even against the most vigilant browsers, as a new analysis from Have I Been Squatted (HIBS) demonstrates. The researchers built a domain that visually mimics apple.com using all-Cyrillic characters: аррӏө.com. It is not identical to the real address, but to most eyes it is close enough to fool a user who lands on it after a mistyped search or URL.
Chromium, the engine behind Chrome, Edge, and Brave, has the most advanced ruleset for catching such homoglyph attacks. It blocks domains that mix Latin and Cyrillic lookalikes, and it maintains a list of 29 Cyrillic characters that routinely masquerade as Latin ones. But the HIBS example slips through because the final character, ө, is a Cyrillic letter that resembles an oval with a line across it—and it is not on that watchlist. The domain therefore renders without triggering Chromium's Punycode fallback.
The case highlights a fundamental problem: Unicode now contains nearly 173,000 characters, and no static list can keep pace with every new lookalike. Domain registries add their own restrictions, but those are not enough either. Given these gaps, HIBS recommends that companies proactively register lookalike domains and encourage passkey adoption, since passkeys are bound to a specific domain and would not work on a spoofed site.