Tactic or Technique: Punycode

Punycode lets attackers register domains that look identical to real ones by swapping Latin characters with visually similar ones from other alphabets. A domain like “apple[.]com” can be faked using a Cyrillic “а,” creating a near-perfect visual match that's easy to overlook.

Phishing emails often use these domains to impersonate trusted brands, support teams, or financial institutions. When you click the link, the address in the browser looks familiar, so you're more likely to trust the site and enter your login details.

Since Punycode relies on subtle character substitutions, it's hard to spot at a glance. Many security tools also fail to decode it properly, which gives attackers a reliable way to steal credentials while bypassing basic detection.