How we registered "apple.com"

The research focuses on typosquatting domains created by substituting visually similar characters from different alphabets (homoglyphs), such as Cyrillic letters that look like Latin ones, to register domains that appear identical to well-known brands (e.g., apple.com). These domains bypass Chromium's current safeguards and can be used for phishing and malware distribution. The report provides a timeline of real-world incidents involving typosquatting and homoglyph attacks targeting companies like Google, Facebook, Binance, and others. It explains how browsers convert these domains to Punycode and the limitations of current detection methods. The research is publicly demonstrated via a website showing these deceptive domains and their Punycode equivalents.

Typosquatting domains using homoglyphs can deceive users into visiting malicious sites that appear legitimate, potentially leading to credential theft, malware infection, financial fraud, and unauthorized access. These attacks exploit browser limitations in detecting visually similar but distinct domain names, increasing the risk of successful phishing campaigns and supply chain compromises. The impact includes exposure of sensitive user data, unauthorized transactions, and compromise of corporate credentials, as documented in multiple historical incidents.

No official vendor advisory or patch is provided for this issue. Browser vendors like Chromium implement safeguards to detect and display Punycode for suspicious domains, but these can be bypassed by carefully crafted homoglyph domains. Users and organizations should remain vigilant about domain names, especially those received via unsolicited messages or emails. Security teams should educate users about the risks of homoglyph attacks and consider deploying domain monitoring solutions to detect lookalike domains targeting their brands. Since this is a research demonstration, no direct patch exists; mitigation relies on user awareness and browser security improvements.