A homograph attack (also called an IDN homograph attack) exploits visually identical or near-identical Unicode characters to forge a domain name that looks like a legitimate one. For example, the Latin letter "a" (U+0061) and the Cyrillic letter "a" (U+0430) are indistinguishable to the human eye but are treated as different characters by computers.
A concrete example: replacing the Latin "a" in "apple.com" with a Cyrillic "a" produces a domain that looks identical but resolves to a completely different server. In 2017, security researcher Xudong Zheng demonstrated this technique and drew widespread attention.
Internationalized Domain Names (IDN) make this attack possible. IDN allows non-ASCII characters (Japanese, Arabic, etc.) in domain names by converting them internally to Punycode (strings starting with xn--). Browsers display the Unicode form in the address bar, making spoofed domains hard to spot.
Shortened URLs face a double risk from homograph attacks. First, the short URL service's own domain could be spoofed with homograph characters. Second, the redirect destination registered in a short URL could be a homograph phishing site. Short URL services are also expected to reject destinations that turn out to be spoofed domains, though visual similarity alone cannot be turned into a mechanical dividing line.
Major browsers defend on the display side, but the conditions for falling back to Punycode differ between them. The display policy Chrome publishes covers not only domains that mix confusable scripts, but also confusable names written entirely in a single script, and names that match a top domain once confusable characters are folded into a common form. Firefox centres on allowing Unicode display when the registry of the top-level domain has stated its own countermeasures, and treats spoofing that replaces every character within one script as something the display side cannot prevent, leaving it to whoever accepts the registration. The case that drew attention in 2017 was written entirely in Cyrillic precisely because that shape slipped past checks relying on script mixing. Seeing Unicode in the address bar is not proof that the domain is legitimate.