Unicode Confusables Outside Latin and Cyrillic

In the realm of domain names and internet security, the concept of Unicode confusables—characters from different scripts that look alike or nearly identical—has been central to understanding and mitigating visual spoofing and homograph attacks. Most discussions around confusables focus heavily on the Latin and Cyrillic scripts, which are particularly prone to visual overlap due to their shared alphabetic roots and typographic similarities. However, confusable characters exist well beyond these two scripts, extending into a wide array of non-Latin systems used across Asia, the Middle East, and parts of Africa. These less frequently examined confusables present both subtle challenges and serious threats in the IDN ecosystem, especially as more users access the internet in native scripts via Internationalized Domain Names.

One of the most fertile grounds for confusable characters is the Arabic script and its various regional adaptations. Arabic, Persian, Urdu, and other languages using Arabic-derived orthography share a base character set but diverge in diacritics, ligatures, and contextual forms. Characters such as U+06A9 (ک, keheh) used in Persian look very similar to U+0643 (ك, kaf) in standard Arabic, particularly in certain typefaces or rendering environments. The visual distinction is often negligible to end users, but the code points differ, enabling the registration of domain names that appear nearly identical but resolve to entirely separate destinations. This visual ambiguity, compounded by contextual shaping rules in Arabic, makes it challenging to detect homographs without script-aware normalization.

The Hebrew script, while smaller in character set and less commonly used in IDNs globally, also contains its share of confusables. Certain characters such as U+05D0 (א, alef) and U+05E2 (ע, ayin) can appear similar in some fonts, especially when rendered at small sizes or without proper typographic differentiation. Additionally, final forms of letters—such as ן (final nun) versus regular נ—can be visually deceptive in stylized text, particularly if users are not familiar with orthographic nuances. While Hebrew IDNs are less prevalent, any registration that visually mimics a known Hebrew word or brand must be scrutinized for possible misrepresentation or abuse.

Indic scripts such as Devanagari, used in Hindi, Marathi, and Nepali, introduce confusables of a different kind. The script’s structure relies on complex ligatures, combining consonants and diacritics in unique ways. Characters like U+0915 (क, ka) and U+091F (ट, ṭa) can resemble each other in stylized fonts, especially when diacritics like the vowel matras are added. Furthermore, visually similar glyphs can be constructed by using different sequences of Unicode characters that normalize to distinct code points. This opens the door for deceptive domain labels where a seemingly innocuous Devanagari domain masks an alternate spelling or intent. The presence of visually overloaded syllabic clusters adds an additional layer of obfuscation, as users may be unable to distinguish a spoofed domain from a legitimate one at a glance.

Southeast Asian scripts such as Thai and Lao are also vulnerable to confusable overlaps. Although they are distinct scripts with different Unicode blocks, several characters between Thai and Lao look nearly identical, including U+0E01 (ก, Thai ko kai) and U+0E81 (ກ, Lao ko), or U+0E2D (อ, Thai o ang) and U+0ECD (ໍ, Lao nikhahit). A domain registered using a Lao character may appear to be Thai to a casual observer, allowing malicious actors to exploit linguistic proximity for regional phishing attempts. Moreover, many users of these scripts are not accustomed to seeing domains in their native writing systems, which can reduce awareness of confusability risks.

Chinese presents a unique challenge in that the script is logographic rather than alphabetic. With over 70,000 ideographic characters encoded in Unicode and thousands in regular use, visual similarity is not just incidental but intrinsic to the script. Many Chinese characters differ by only a stroke or radical, such as 木 (tree) and 本 (root), or 日 (sun) and 目 (eye). While the risk of confusion is somewhat mitigated by the requirement that domain labels be composed of allowed characters as defined in IDN tables, the sheer volume of near-duplicate ideographs makes total prevention impractical. Additionally, traditional and simplified forms of the same character often occupy different code points but appear similar or identical depending on font settings. A domain name registered using a traditional variant might be visually indistinguishable from a simplified version, yet be treated as a different domain altogether.

Japanese, which uses a mix of kanji (Chinese characters), hiragana, and katakana, brings added complexity to the confusable issue. Katakana and hiragana syllables often appear nearly identical in casual rendering. For example, the katakana ア (a) and the hiragana あ (a) differ subtly in form, but the distinction is not always maintained in smaller font sizes or poorly rendered displays. Furthermore, katakana includes characters that closely mimic Latin letters, such as ロ (ro) resembling a capital P or コ (ko) resembling a sideways capital E. These similarities can be exploited for creating domains that target bilingual audiences, where one part of the name appears in katakana and mimics a Latin-brand label.

Korean Hangul, though less frequently associated with homograph attacks, does include structural elements that can create deceptive lookalikes. Hangul syllables are block-structured combinations of initial, medial, and final components. A domain label composed of visually similar syllables like 민 and 빈 may differ only in the position of one consonant or vowel, and users not attuned to these orthographic subtleties may be misled. Additionally, compatibility jamos and modern jamos occupy separate Unicode ranges, and different encoding sequences may yield visually equivalent but technically distinct domain names.

The prevalence of confusables in these non-Latin, non-Cyrillic scripts illustrates the urgent need for script-specific mitigation strategies. ICANN and the Unicode Consortium have made strides through initiatives like the Label Generation Rules (LGRs), which define valid character sets and variant mappings for each script used in top-level domains. However, enforcement varies across registries, and the rapid expansion of new IDNs in regional markets may outpace policy development. Technologies like skeleton string comparison and normalization are useful, but they require continual updates to reflect script-specific peculiarities.

For registrars, registries, and brand holders, understanding confusables outside the Latin and Cyrillic domains is no longer optional—it is essential. Defensive registration, visual similarity audits, and script-aware monitoring must be extended to include all scripts in which a brand operates or may be impersonated. As the global internet becomes increasingly multilingual, so too does the threat surface for homograph attacks. Recognizing that confusability is not just a Latin-Cyrillic issue but a global Unicode phenomenon is the first step toward building a more secure and linguistically inclusive domain namespace.

You said:

In the realm of domain names and internet security, the concept of Unicode confusables—characters from different scripts that look alike or nearly identical—has been central to understanding and mitigating visual spoofing and homograph attacks. Most discussions around confusables focus heavily on the Latin and Cyrillic scripts, which are particularly prone to visual overlap due to…