A homograph attack (also called an IDN homograph attack) exploits visually identical or near-identical Unicode characters to forge a domain name that looks like a legitimate one. For example, the Latin letter "a" (U+0061) and the Cyrillic letter "a" (U+0430) are indistinguishable to the human eye but are treated as different characters by computers.
A concrete example: replacing the Latin "a" in "apple.com" with a Cyrillic "a" produces a domain that looks identical but resolves to a completely different server. In 2017, security researcher Xudong Zheng demonstrated this technique and drew widespread attention.
Internationalized Domain Names (IDN) make this attack possible. IDN allows non-ASCII characters (Japanese, Arabic, etc.) in domain names by converting them internally to Punycode (strings starting with xn--). Browsers display the Unicode form in the address bar, making spoofed domains hard to spot.
Shortened URLs face a double risk from homograph attacks. First, the short URL service's own domain could be spoofed with homograph characters. Second, the redirect destination registered in a short URL could be a homograph phishing site. URL shortening services should convert registered domains to Punycode and check them against known phishing domain databases.
Major browsers have implemented defenses. Chrome and Firefox switch to Punycode display when a domain mixes characters from different scripts, alerting users to a potentially suspicious domain. You can find related books on Amazon.