--- title: Two characters open up a world of typosquatting... description: Security researchers at Have I Been Squatted found that rare Cyrillic and Latin characters, like the Cyrillic barred-o (ө) and Latin K with hook (ƙ), can... canonical: https://daily.dev/posts/two-characters-open-up-a-world-of-typosquatting-opportunities-in-chromium-browsers-qqpad6deq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Two characters open up a world of typosquatting opportunities in Chromium browsers | daily.dev og:description: Security researchers at Have I Been Squatted found that rare Cyrillic and Latin characters, like the Cyrillic barred-o (ө) and Latin K with hook (ƙ), can... og:url: https://daily.dev/posts/two-characters-open-up-a-world-of-typosquatting-opportunities-in-chromium-browsers-qqpad6deq og:image: https://api.daily.dev/og/posts/qQpAd6DEQ.png og:image:alt: Two characters open up a world of typosquatting opportunities in Chromium browsers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Two characters open up a world of typosquatting opportunities in Chromium browsers **[The Register](https://daily.dev/sources/theregister)** · 7 min read · 0 upvotes · 0 comments ## Summary Security researchers at Have I Been Squatted found that rare Cyrillic and Latin characters, like the Cyrillic barred-o (ө) and Latin K with hook (ƙ), can bypass Chromium's two main anti-spoofing defenses: the SafeToDisplayAsUnicode function and the GetSimilarTopDomain skeleton-matching check. These 'breaker' characters let attackers register lookalike domains such as аррӏө[.]com and oƙta[.]com that display as legitimate-looking Unicode instead of being flagged and shown as Punycode. The researchers registered 20 such demo domains and also found Chromium's Safety Tips navigation warnings fail to trigger for multi-character substitutions, short domains, or infrequently visited sites. Testing showed Gmail displayed all 20 lookalike domains in deceptive Unicode, while Outlook Web over-corrected by showing even legitimate IDNs as Punycode. Scanning ICANN's full .com registry turned up roughly 162,000 internationalized domain names that resemble plain ASCII domains, though not all are malicious. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do attackers bypass Chrome's Punycode warning for lookalike domains? Attackers use rare characters called 'breakers' that aren't on Chromium's hardcoded Cyrillic lookalike list, such as ө, ї, and ү, which bypass the SafeToDisplayAsUnicode all-or-nothing check. They also exploit the GetSimilarTopDomain skeleton-matching function by using characters like the Latin K with hook (ƙ), which gets converted into a combining mark rather than matched to a plain Latin letter, so the resulting skeleton never matches the real domain it imitates. _daily.dev surfaces security research like this for teams hardening phishing and domain-spoofing defenses._ ### Why didn't Chrome show a security warning popup for the fake oƙta.com domain? Chrome's Safety Tips warnings only trigger for an exact-character match, a one-edit match, or an adjacent-letter swap against a known domain, and never trigger for domains under five characters. Oƙta.com is only four characters and one edit away from the real Okta domain, so it falls under the length threshold and can slip past the warning despite being a clear lookalike. _Teams building phishing detection can track these browser-defense edge cases on daily.dev._ ### How many Punycode internationalized domains look like real ASCII domain names on the .com registry? Around 162,000 pairs were found where an internationalized domain name (IDN) resembles a plain ASCII domain, out of roughly 733,000 IDNs among the .com registry's approximately 167 million domains. Not all of these are malicious typosquats; some are registered defensively by legitimate businesses or used for multilingual versions of the same site. _daily.dev helps security researchers keep tabs on domain-spoofing scale and trends like this._ ## Similar posts on daily.dev - [Same Look, Different Code: The Technical Reality Behind Homoglyph Attacks](https://daily.dev/posts/same-look-different-code-the-technical-reality-behind-homoglyph-attacks-y0zjzlc1m) · Security Boulevard · 0 upvotes · 0 comments - [I rendered 1,418 Unicode confusable pairs across 230 fonts. Most aren't confusable to the eye.](https://daily.dev/posts/i-rendered-1-418-unicode-confusable-pairs-across-230-fonts-most-aren-t-confusable-to-the-eye--9tc3tpp5r) · Hacker News · 0 upvotes · 1 comments - [Punycode: My New Favorite Algorithm](https://daily.dev/posts/punycode-my-new-favorite-algorithm-oizfhofuk) · Lobsters · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#phishing](https://daily.dev/tags/phishing), [#chromium](https://daily.dev/tags/chromium) [View this post on daily.dev](https://daily.dev/posts/two-characters-open-up-a-world-of-typosquatting-opportunities-in-chromium-browsers-qqpad6deq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Two characters open up a world of typosquatting opportunities in Chromium browsers","url":"https://daily.dev/posts/two-characters-open-up-a-world-of-typosquatting-opportunities-in-chromium-browsers-qqpad6deq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/two-characters-open-up-a-world-of-typosquatting-opportunities-in-chromium-browsers-qqpad6deq"},"datePublished":"2026-10-10T10:19:36.774Z","dateModified":"2026-10-10T10:20:02.572Z","description":"Security researchers at Have I Been Squatted found that rare Cyrillic and Latin characters, like the Cyrillic barred-o (ө) and Latin K with hook (ƙ), can...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ba936836dd948bd83f454d692b6b597e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ba936836dd948bd83f454d692b6b597e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/two-characters-open-up-a-world-of-typosquatting-opportunities-in-chromium-browsers-qqpad6deq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,phishing,chromium","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Two characters open up a world of typosquatting opportunities in Chromium browsers"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/two-characters-open-up-a-world-of-typosquatting-opportunities-in-chromium-browsers-qqpad6deq#faq","mainEntity":[{"@type":"Question","name":"How do attackers bypass Chrome's Punycode warning for lookalike domains?","acceptedAnswer":{"@type":"Answer","text":"Attackers use rare characters called 'breakers' that aren't on Chromium's hardcoded Cyrillic lookalike list, such as ө, ї, and ү, which bypass the SafeToDisplayAsUnicode all-or-nothing check. They also exploit the GetSimilarTopDomain skeleton-matching function by using characters like the Latin K with hook (ƙ), which gets converted into a combining mark rather than matched to a plain Latin letter, so the resulting skeleton never matches the real domain it imitates. daily.dev surfaces security research like this for teams hardening phishing and domain-spoofing defenses."}},{"@type":"Question","name":"Why didn't Chrome show a security warning popup for the fake oƙta.com domain?","acceptedAnswer":{"@type":"Answer","text":"Chrome's Safety Tips warnings only trigger for an exact-character match, a one-edit match, or an adjacent-letter swap against a known domain, and never trigger for domains under five characters. Oƙta.com is only four characters and one edit away from the real Okta domain, so it falls under the length threshold and can slip past the warning despite being a clear lookalike. Teams building phishing detection can track these browser-defense edge cases on daily.dev."}},{"@type":"Question","name":"How many Punycode internationalized domains look like real ASCII domain names on the .com registry?","acceptedAnswer":{"@type":"Answer","text":"Around 162,000 pairs were found where an internationalized domain name (IDN) resembles a plain ASCII domain, out of roughly 733,000 IDNs among the .com registry's approximately 167 million domains. Not all of these are malicious typosquats; some are registered defensively by legitimate businesses or used for multilingual versions of the same site. daily.dev helps security researchers keep tabs on domain-spoofing scale and trends like this."}}]} ```