Skip to main content

What are homoglyphs and lookalike ENS names?

A homoglyph is a character that looks like another but isn't. Two ENS names can render identically and point at different wallets. How to tell.

A homoglyph is a character that looks like another character but isn't the same character. Unicode contains thousands of them: a Cyrillic е renders the same as a Latin e, a small-capital ɴ passes for an n, and a Zero-Width Joiner shows nothing at all.

ENS names are made of Unicode characters. So two names can render identically on screen and be different names, owned by different people, pointing at different wallets. Scammers register homoglyph versions of valuable names and wait for someone to send funds without checking. vita‍lik.eth with an invisible joiner. еns.eth with a Cyrillic first letter.

Nothing on screen tells you which one you're looking at. You have to read the characters.

Good to know

  • The official ENS App at app.ens.domains strips a lot of Unicode tricks automatically. Names registered through the App can't contain variation selectors or uppercase letters. Scammers get round this by registering through smart contracts or third-party tools.

  • A Unicode warning on a marketplace means the name contains unusual characters. It doesn't mean the name is fraudulent, since plenty of legitimate emoji names trip the same flag.

  • Homoglyph names target high-value names. A vitalik.eth listing priced cheaply is almost certainly a fake.

  • ENS support can't reverse a transaction sent to a homoglyph. Check the name before you send.

Why two identical-looking names are different names

Every character has a code point, a number that identifies it. The Latin e is U+0065. The Cyrillic е is U+0435. Your screen draws them the same way; the computer treats them as unrelated.

ENS works on the code points, not the picture. ens.eth and еns.eth are two separate registrations. Each has its own owner, its own records, its own wallet address. Neither one knows about the other.

That is the whole attack. There is no bug to fix and nothing to reverse, because the two names were never the same name.

The five families of homoglyph

They all rely on Unicode characters that look identical or near-identical to standard letters but use different code points underneath.

Family

What it looks like

Analyser flag

Zero-Width Joiner

Invisible character between letters

"Zero-Width Joiner"

Variation Selector

Invisible character after a letter

"Variation Selector"

Cross-script confusable

Cyrillic е instead of Latin e, and so on

"Cyrillic", "Greek", "Armenian"

Small capital

ɴ instead of n

"Latin Letter Small Capital"

Digit-set swap

Arabic ٤ or Persian ۴ instead of Latin 4

"Arabic-Indic Digit" or "Extended Arabic-Indic Digit"

Zero-Width Joiners

A Zero-Width Joiner (ZWJ) is an invisible character designed to combine emoji: that's how ❤️‍🔥 is built from a heart, a variation selector, a ZWJ and a fire emoji. Slipped between the letters of an ENS name, it creates a separate name that renders identically. vita‍lik.eth with a ZWJ between the a and the l is the canonical example.

Run both through an analyser and the difference is plain:

  • Real vitalik.eth: v, i, t, a, l, i, k, ., e, t, h. All standard Latin.

  • Fake vita‍lik.eth: v, i, t, a, Zero-Width Joiner, l, i, k, ., e, t, h. One extra invisible character.

Confusables: letters from other alphabets

The Latin e (U+0065) and the Cyrillic е (U+0435) look identical in most fonts. Cyrillic, Greek, Armenian and several other scripts carry near-identical twins for common Latin letters. This is the largest family by far.

For a tour of every confusable Unicode tracks, use the Unicode Consortium's Confusables utility and Raffy's ens-normalize confusables tool.

Small capitals

ɴ (U+0274) and (U+1D0D) are small-capital forms of n and m. They render like uppercase letters but sit in a separate Unicode block, so a name using them is a different name from the one it imitates.

Arabic and Persian digits

Arabic numerals (٠١٢٣٤٥٦٧٨٩) and Persian digits (۰۱۲۳۴۵۶۷۸۹) look identical to most readers but use different code points. Mixed with Latin digits inside one name, they turn up regularly in support tickets.

Variation Selectors

Variation Selectors are invisible code points that change how the previous character renders, for example turning a black heart into a colour emoji. The ENS App strips them during normalisation, so names containing them are invalid there. A name registered through a contract or a third-party service can still carry one.

What ENS blocks, and what it doesn't

Register through the official ENS App at app.ens.domains and normalisation runs in the background:

  • Variation selectors are stripped; names containing them are invalid.

  • Uppercase letters are converted to lowercase; names containing them are invalid.

  • Many confusable characters are blocked outright.

The catch is where the protection sits. Normalisation stops you from creating an invalid name. It doesn't stop someone else registering a homoglyph directly through a smart contract or a third-party service, then sending you payment instructions that point at it.

So the App protects the names you make. It can't protect the names you're given.

How to check a name

  1. Copy the full name from wherever you found it.

  2. Paste it into a Unicode analyser. fontspace.com/unicode/analyzer is a quick one. It breaks the name into characters and labels each.

  3. Read the breakdown. Every character should be a plain Latin letter, a digit (09), a hyphen, or an emoji you can identify. Reject the name if you see:

    • Zero-Width Joiner or ZWJ

    • Variation Selector

    • Cyrillic, Greek, Armenian, or any non-Latin alphabet label

    • Small Capital, for letters like ɴ, , ʀ

    • Arabic-Indic Digit or Extended Arabic-Indic Digit mixed with Latin digits

If the analyser shows only plain Latin letters and standard digits, what you see is what you get.

When it's worth checking

  • Someone sent you a name and asked for funds. Treat it as unverified until you've read the characters.

  • A name resembling a famous name is listed cheaply. The price is the warning before the characters are.

  • A marketplace shows a warning triangle or asterisk. That means unusual characters, not necessarily fraud.

  • You already sent funds and aren't sure. The transaction is permanent and ENS can't reverse it, but checking tells you what happened.

Other warning signs

Price. Homoglyph names target high-value names. A name resembling a well-known one and priced far below what the real one would fetch is a warning on its own.

Source. A name sent by DM, comment or unsolicited message gets extra scrutiny. People expecting crypto don't usually send their address by private message.

Branding. A name copying a public figure or project that doesn't appear on their verified channels, such as their X profile, their site or their Discord, is almost certainly fake. Check the channels you already trust, not the one pushing the name at you.

Marketplace flags. These flag names containing unusual Unicode characters. The flag means "unusual characters", not "scam". Check with an analyser before acting either way.

  • OpenSea: warning triangle next to the name.

  • Etherscan: asterisk (*) before any name that contains characters outside a-z and 0-9.

  • ENS.Vision: warning triangle next to the name.

Did this answer your question?