# Researchers show Cyrillic domain can evade Chromium lookalike checks

_Published Sunday, October 18, 2026 at 10:06 AM EDT · Security · Latest · Tier 2 — Notable_

![Russian dictionary — Primary](https://cdn.mos.cms.futurecdn.net/SQzRnE4jQMZ8s6EjxkPFB6-2560-80.jpg)

Researchers at Have I Been Squatted demonstrated a Cyrillic domain that evades Chromium's safeguards against addresses resembling legitimate websites, Tom's Hardware reports. The example resembles apple.com but uses a character outside Chromium's list of 29 Cyrillic characters commonly used to imitate Latin letters.

Chromium normally exposes suspicious addresses by displaying their encoded Punycode form. The all-Cyrillic example passes checks that reject mixed alphabets and familiar lookalike combinations. HIBS recommends passkeys, which bind authentication to a specific domain and prevent users from logging into an impersonating site with those credentials.

## Sources

- [Tom's Hardware](https://www.tomshardware.com/tech-industry/cyber-security/typo-squatting-attacks-with-major-domains-are-still-viable-corner-cases-with-cyrillic-characters-still-evade-the-best-checks)

---
Canonical: https://techandbusiness.org/newswire/pJTPmMYaDVjQqyl7z4JZoI
Published: 2026-10-18T14:06:54.546Z
Story chronology: 2026-10-18T12:05:00.000Z
Retrieved: 2026-10-18T17:09:26.609Z
Publisher: Tech & Business (techandbusiness.org)