Observed arrival · 2026-09-27
A Cyrillic lookalike hiding in plain sight
This research demo shows how five Cyrillic characters can make a registered domain resemble apple.com, and explains how browsers handle the lookalike.
- For
- Security teams studying lookalike domains
- Worth noticing
- Both comparison rows use the visitor’s interface font; hovering animates the Latin e and Cyrillic ө.
Field notes
The page renders the registered domain as аррӏө.com and contrasts its five Cyrillic characters with Latin “apple,” using the device’s interface font and a hover animation to expose the shapes. It explains that the browser resolves the ASCII Punycode form, xn--80a6aa68c8d.com, while Chrome may display readable characters when its imitation checks permit them; the page says this specimen passes that check. It also recommends direct navigation, bookmarks, password-manager autofill, and current browser updates. A longer technical write-up is described as forthcoming.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue