A confusable is a character that looks like another character, often because it comes from a different writing system. For example, Latin and Cyrillic letters can be nearly indistinguishable to the human eye, even though they are different Unicode code points and may belong to different scripts.
In cybersecurity, confusables matter because they enable visual deception. Attackers use them in internationalized domain names, filenames, usernames, and messages to create lookalike strings that fool users at a glance. This is a common ingredient in phishing and brand impersonation, where a hostile domain can appear trustworthy in the browser’s address bar. Defenders reduce the risk by detecting mixed-script names, comparing Unicode labels against known brands, forcing suspicious domains into punycode, and using tools that match exact origins rather than relying on visual similarity.