The attack
Ever since domains have been allowed to contain non-Latin characters (Internationalized Domain Names, IDN), it has been possible to build a domain name visually indistinguishable from a genuine one. The Cyrillic "а" (U+0430) looks exactly like the Latin "a" in virtually every typeface — yet it is an entirely different character and therefore an entirely different domain.
An attacker registers a domain that, in the inbox, looks like your bank's, your payment provider's or your own company's. No amount of recipient attentiveness can spot the difference in plain text. Technically the domain is encoded as punycode (xn--), but what gets displayed is the readable form.
What AnalyzeMy.Email checks
- Sender domain for mixed scripts — Latin and Cyrillic characters within one label, for instance
- Confusable characters from Cyrillic, Greek and other character sets
- All link domains in the message body against the same criteria
- Punycode resolution — the actual
xn--form is made visible
Interpreting the result
A hit is not automatically an attack. Domains in Cyrillic, Greek, Arabic or Asian script are entirely legitimate when written consistently in one script — a Russian company with a Russian domain is not phishing.
What makes it suspicious is the mixture: a label combining Latin and Cyrillic characters practically never has a legitimate reason. That is exactly what the detection targets. A hit on a domain resembling a well-known brand is a strong warning sign.
Countermeasures
- On the receiving side: modern browsers display mixed-script domains as punycode. Mail clients do not do this consistently — so the protection has to sit on the gateway.
- For your own brand: regularly check whether look-alike domains have been registered. Many registrars offer monitoring.
- DMARC with p=reject protects against abuse of your real domain, not against look-alikes. These are different attacks requiring different answers.
- User training only helps so much here — the difference simply is not visually perceptible.