DarkOwl Shows How Homoglyph Domains Impersonate Crypto, Technology and Retail Sites

Summary

DarkOwl analysts explain how lookalike domains using characters from different scripts can impersonate legitimate sites to steal credentials or financial information, with examples and advice for spotting and avoiding them.

Key points

• IDN homoglyph attacks use visually similar characters from different scripts to make spoofed domains resemble legitimate websites; unlike typosquatting, they do not rely on a user mistyping the address.
• DarkOwl lists examples impersonating cryptocurrency wallets and services, technology vendors, and retailers, including metamasķ[.]com and treźor[.]com.
• The article says some listed sites appeared designed to support phishing, while others had blank pages or missing index pages; it does not establish the outcome of attacks against victims.
• DarkOwl analysts say they observed fewer homoglyph attacks than previously, but warn that spoofing domains could become more complex.
• The article advises keeping browsers updated, checking URLs, avoiding suspicious links, and heeding browser warnings.
• It also recommends browser tools to identify suspicious domains and reporting suspected phishing sites.

MITRE ATT&CK

Industries