Detect International Character Lookalike Domains in Email

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects potential phishing attempts by identifying emails where the sender's address contains international (Cyrillic) characters that look similar to Latin characters (homoglyphs) and the subject line contains keywords often associated with phishing, such as 'verify', 'confirm', or 'urgent'. This combination suggests an attempt to spoof legitimate domains using visual deception.