Detect and Notify about Homograph Attacks

[AnshulGadgoli]

Homograph involves replicating a letter by using the same letter in a different language. Therefore, take the example of

• apple.com (this is a legitimate site)
• аррle.com (whereas this is a Phishing URL. Here, the 'a' in the URL is the Cyrillic 'а').

These URLs look identical, but attackers may lure the user to their desired cracked site. Hence, the fix is vital.

[AnshulGadgoli]

@Mrinalray , I would want to work on this issue and fix it. This is in light to GSSOC'26 by the way. Would really appreciate it if you could assign this task to me.

[Diwakar-odds]

Hi @Mrinalray, I am interested in working on this issue under ECSoC '26.

I have reviewed the issue description and the existing codebase (server.js, script.js). Here is my implementation plan:

Implementation Plan

1. Homograph Detection Utility

• Create a utility function (e.g., detectHomograph(url)) that checks whether a URL contains mixed-script characters (e.g., Cyrillic 'а' mixed with Latin 'a').
• Use Unicode script detection to identify characters from non-Latin scripts (Cyrillic, Greek, etc.) that visually resemble Latin letters.
• Maintain a mapping of common homoglyph pairs for accurate detection.

2. Backend Integration (server.js)

• Add the homograph check as a validation step in the /check route, before the Google Safe Browsing API call.
• If a homograph attack is detected, immediately return a threat response with a clear warning message explaining the attack type, without consuming API quota.

3. Frontend Notification (script.js / index.html)

• Display a distinct, visually prominent warning when a homograph attack is detected, differentiating it from standard threat responses.
• Show the suspicious characters highlighted so the user can see the difference.

Files to be Modified/Created

• server.js: Add homograph validation in the /check route.
• script.js: Handle and display homograph-specific threat responses.
• style.css: Add styling for the homograph warning UI.

This is a critical cybersecurity feature — looking forward to contributing!

[Mrinalray]

@AnshulGadgoli assigned