Cyrillic lookalike domain аррӏө.com slips past Chromium defenses

Security research published by Have I Been Squatted shows that a domain built from Cyrillic lookalike characters, written as аррӏө.com, is not caught by Chromium's typo-squatting protections even though it closely resembles apple.com, according to tomshardware.com.

The bypass comes down to a single character. Chromium keeps a list of 29 Cyrillic characters that resemble Latin letters and rejects domains made up entirely of them, but the Cyrillic ө is not on that list, so аррӏө.com is never converted to its Punycode form.

Mixed-script domains behave differently. A domain that pairs one Cyrillic homoglyph with Latin letters, such as the Cyrillic а followed by pple.com, is displayed in Punycode as xn--pple-43d.com, which makes the substitution visible to the user.

How Chromium screens domains

Chromium maintains a list of more than 8,000 popular domains considered likely typo-squatting targets and runs stronger checks on 836 of them. A 2020 study cited in the research found that Chromium caught 64.1% of lookalike-domain attempts, ahead of Firefox and Safari. Chromium is the engine behind the Chrome, Edge and Brave browsers.

The Unicode character set now contains nearly 173,000 entries. Have I Been Squatted recommends that companies register lookalike domains of their own and encourage users to adopt passkeys, which are not exposed to this type of impersonation.