A visual spoofing (homograph) attack occurs when characters that appear visually identical or nearly indistinguishable are substituted to deceive users or systems. These characters originate from different Unicode code points but render similarly in most fonts. Adversaries exploit these similarities to craft deceptive domain names, file names, or identifiers that trick users into trusting malicious resources (e.g., `аррӏе.com` vs. `apple.com`).

Remediation

• Normalise and validate input to restrict or reject mixed-script identifiers (e.g., disallow Cyrillic + Latin characters in the same domain or username).
• Use Punycode (`xn--`) representation for internationalised domain names (IDN) to expose deceptive Unicode characters to users and detection systems.
• Apply allow-lists for acceptable character sets in usernames, domains, or identifiers.
• Educate users and administrators to recognise Punycode-prefixed domains in logs, emails, and browsers.
• Leverage browser or application security features that flag mixed-script or confusable characters.