A homoglyph is a character that looks like another character but isn't the same character. Unicode contains thousands of them: a Cyrillic е renders the same as a Latin e, a small-capital ɴ passes for an n, and a Zero-Width Joiner shows nothing at all.
ENS names are made of Unicode characters. So two names can render identically on screen and be different names, owned by different people, pointing at different wallets. Scammers register homoglyph versions of valuable names and wait for someone to send funds without checking. vitalik.eth with an invisible joiner. еns.eth with a Cyrillic first letter.
Nothing on screen tells you which one you're looking at. You have to read the characters.
Good to know
The official ENS App at
app.ens.domainsstrips a lot of Unicode tricks automatically. Names registered through the App can't contain variation selectors or uppercase letters. Scammers get round this by registering through smart contracts or third-party tools.A Unicode warning on a marketplace means the name contains unusual characters. It doesn't mean the name is fraudulent, since plenty of legitimate emoji names trip the same flag.
Homoglyph names target high-value names. A
vitalik.ethlisting priced cheaply is almost certainly a fake.ENS support can't reverse a transaction sent to a homoglyph. Check the name before you send.
Why two identical-looking names are different names
Every character has a code point, a number that identifies it. The Latin e is U+0065. The Cyrillic е is U+0435. Your screen draws them the same way; the computer treats them as unrelated.
ENS works on the code points, not the picture. ens.eth and еns.eth are two separate registrations. Each has its own owner, its own records, its own wallet address. Neither one knows about the other.
That is the whole attack. There is no bug to fix and nothing to reverse, because the two names were never the same name.
The five families of homoglyph
They all rely on Unicode characters that look identical or near-identical to standard letters but use different code points underneath.
Family | What it looks like | Analyser flag |
Zero-Width Joiner | Invisible character between letters | "Zero-Width Joiner" |
Variation Selector | Invisible character after a letter | "Variation Selector" |
Cross-script confusable | Cyrillic | "Cyrillic", "Greek", "Armenian" |
Small capital |
| "Latin Letter Small Capital" |
Digit-set swap | Arabic | "Arabic-Indic Digit" or "Extended Arabic-Indic Digit" |
Zero-Width Joiners
A Zero-Width Joiner (ZWJ) is an invisible character designed to combine emoji: that's how ❤️🔥 is built from a heart, a variation selector, a ZWJ and a fire emoji. Slipped between the letters of an ENS name, it creates a separate name that renders identically. vitalik.eth with a ZWJ between the a and the l is the canonical example.
Run both through an analyser and the difference is plain:
Real
vitalik.eth:v,i,t,a,l,i,k,.,e,t,h. All standard Latin.Fake
vitalik.eth:v,i,t,a, Zero-Width Joiner,l,i,k,.,e,t,h. One extra invisible character.
Confusables: letters from other alphabets
The Latin e (U+0065) and the Cyrillic е (U+0435) look identical in most fonts. Cyrillic, Greek, Armenian and several other scripts carry near-identical twins for common Latin letters. This is the largest family by far.
For a tour of every confusable Unicode tracks, use the Unicode Consortium's Confusables utility and Raffy's ens-normalize confusables tool.
Small capitals
ɴ (U+0274) and ᴍ (U+1D0D) are small-capital forms of n and m. They render like uppercase letters but sit in a separate Unicode block, so a name using them is a different name from the one it imitates.
Arabic and Persian digits
Arabic numerals (٠١٢٣٤٥٦٧٨٩) and Persian digits (۰۱۲۳۴۵۶۷۸۹) look identical to most readers but use different code points. Mixed with Latin digits inside one name, they turn up regularly in support tickets.
Variation Selectors
Variation Selectors are invisible code points that change how the previous character renders, for example turning a black heart into a colour emoji. The ENS App strips them during normalisation, so names containing them are invalid there. A name registered through a contract or a third-party service can still carry one.
What ENS blocks, and what it doesn't
Register through the official ENS App at app.ens.domains and normalisation runs in the background:
Variation selectors are stripped; names containing them are invalid.
Uppercase letters are converted to lowercase; names containing them are invalid.
Many confusable characters are blocked outright.
The catch is where the protection sits. Normalisation stops you from creating an invalid name. It doesn't stop someone else registering a homoglyph directly through a smart contract or a third-party service, then sending you payment instructions that point at it.
So the App protects the names you make. It can't protect the names you're given.
How to check a name
Copy the full name from wherever you found it.
Paste it into a Unicode analyser. fontspace.com/unicode/analyzer is a quick one. It breaks the name into characters and labels each.
Read the breakdown. Every character should be a plain Latin letter, a digit (
0–9), a hyphen, or an emoji you can identify. Reject the name if you see:Zero-Width Joiner or ZWJ
Variation Selector
Cyrillic, Greek, Armenian, or any non-Latin alphabet label
Small Capital, for letters like
ɴ,ᴍ,ʀArabic-Indic Digit or Extended Arabic-Indic Digit mixed with Latin digits
If the analyser shows only plain Latin letters and standard digits, what you see is what you get.
When it's worth checking
Someone sent you a name and asked for funds. Treat it as unverified until you've read the characters.
A name resembling a famous name is listed cheaply. The price is the warning before the characters are.
A marketplace shows a warning triangle or asterisk. That means unusual characters, not necessarily fraud.
You already sent funds and aren't sure. The transaction is permanent and ENS can't reverse it, but checking tells you what happened.
Other warning signs
Price. Homoglyph names target high-value names. A name resembling a well-known one and priced far below what the real one would fetch is a warning on its own.
Source. A name sent by DM, comment or unsolicited message gets extra scrutiny. People expecting crypto don't usually send their address by private message.
Branding. A name copying a public figure or project that doesn't appear on their verified channels, such as their X profile, their site or their Discord, is almost certainly fake. Check the channels you already trust, not the one pushing the name at you.
Marketplace flags. These flag names containing unusual Unicode characters. The flag means "unusual characters", not "scam". Check with an analyser before acting either way.
OpenSea: warning triangle next to the name.
Etherscan: asterisk (
*) before any name that contains characters outsidea-zand0-9.ENS.Vision: warning triangle next to the name.




