The browser-side defenses exist but they're opt-in or inconsistent, which is why this keeps working:
Chrome and Firefox show punycode (xn--) in the URL bar only when a domain mixes scripts in a way that trips their heuristics (Firefox's network.IDN_show_punycode is on by default now, but mixed-script confusables within Latin aren't always caught).
The robust check anyone can do: paste the domain into a Unicode tool and look for codepoints outside ASCII. Cyrillic а (U+0430) vs Latin a (U+0061) is invisible in most fonts.
Password managers are the real practical defense — they match on exact registrable domain, so autofill simply refuses to fill on homograph domains. That's why the "use a password manager" advice kills two birds.
For the electoral version of this — same-name candidates, lookalike domains, cloned logos — there's no technical patch at all. It exploits identity verification humans do by pattern-matching names, not codepoints. Registration transparency (whois history showing a cluster of recently-registered lookalike domains before an election) is about the only early-warning signal that exists.
If you want to play with how bad it gets: dnstwist generates homograph/permutation domains for any target and shows which ones are registered. Running it on a candidate's name domain usually returns dozens of live hits before an election.
The browser-side defenses exist but they're opt-in or inconsistent, which is why this keeps working:
xn--) in the URL bar only when a domain mixes scripts in a way that trips their heuristics (Firefox'snetwork.IDN_show_punycodeis on by default now, but mixed-script confusables within Latin aren't always caught).For the electoral version of this — same-name candidates, lookalike domains, cloned logos — there's no technical patch at all. It exploits identity verification humans do by pattern-matching names, not codepoints. Registration transparency (whois history showing a cluster of recently-registered lookalike domains before an election) is about the only early-warning signal that exists.
If you want to play with how bad it gets: dnstwist generates homograph/permutation domains for any target and shows which ones are registered. Running it on a candidate's name domain usually returns dozens of live hits before an election.