Cyrillic Character Domain Phishing Can Imitate Exchange Wallet Official Websites
A new type of domain phishing uses visually similar Cyrillic characters to replace English letters, making the URL visually almost identical to the real domain, but the computer recognizes it as a different address.
In the example, the fake URL uses the Russian Cyrillic character "а" to form аmazon.com, which looks very similar to the real amazon.com's English letter "a" but points to a different website.
This method poses a high risk to cryptocurrency users, as attackers can forge exchange, wallet, or DeFi protocol official domain names and replicate login pages to steal account passwords or induce users to connect wallets and sign malicious authorizations.
Even if users check the URL multiple times, they may still enter a fake site due to character visual consistency; accessing through bookmarks or official apps can reduce risk.
Links sent via private messages for airdrops, compensation, or emergency migrations, even if the URL appears completely correct, should not easily trigger wallet connections or signatures.
This phishing relies on homographic characters in the international domain name character set, rendering manual visual checks ineffective, while system parsing treats them as independent domains.
Source: Public Information
ABAB AI Insight
Domain phishing has long exploited visually similar characters for imitation, and the homographic nature of Cyrillic and Latin letters has been used in international domains to impersonate mainstream websites; this description applies the method to the cryptocurrency scene, forging exchange, wallet, and DeFi protocol official websites to steal credentials or induce malicious signatures.
In the attack path, attackers register visually similar domain names, replicate login interfaces, guide users in through private messages or search results, and then collect passwords or induce wallet authorizations; users relying on visual checks rather than bookmarks or official entrances increase their risk.
This is similar to traditional phishing practices that use similar domain names or IDNs (Internationalized Domain Names) to impersonate banks and e-commerce, or common methods in the cryptocurrency field that impersonate official websites to induce wallet connections; currently, users' vigilance towards link sources has decreased following the proliferation of AI and automation tools, while domain impersonation technology continues to exist.
Essentially, this is a matter of technical substitution and information asymmetry: visual checks are bypassed by homographic characters, rendering manual verification ineffective, while system-level parsing and bookmark entries become effective defenses; attackers exploit character encoding differences to direct traffic to malicious sites, making credentials and authorizations directly stealable assets, with funds flowing from user wallets to addresses controlled by attackers.
ABAB News · Cognitive Law
Visual similarity does not equal system similarity; homographic characters can point to different sites.
Bookmarks and official entrances are structural defenses against domain impersonation.
Private message links, even if visually correct, should not trigger wallet connections and signatures.