spam.mixed_script
A single word mixes Latin letters with Cyrillic or Greek letters that look like Latin ones.
What it looks at#
Whether any ONE word mixes genuine Latin letters with Cyrillic or Greek letters that are
near-identical to Latin ones in most fonts — Cyrillic “а” (U+0430) next to Latin “pple”,
for instance. This is homoglyph substitution, the trick behind lookalike domains and
links (аpple.com).
Legitimate mixed-script text is untouched. “iPhone с чехлом” (“iPhone with a case”) mixes an English product name with Cyrillic prose, but “iPhone” and “с” are two separate, single-script words — this check only looks inside one word, never across a whole sentence, so ordinary code-switching and product names next to non-Latin text never fire.
The lookalike set is curated (the most commonly abused Cyrillic and Greek letters), not the full Unicode confusables table — a known, documented gap, not every possible homoglyph across every script.
Why it matters#
Homoglyph substitution is used to spoof brand names and domains in a way that reads identically to a human but doesn’t match any exact-string block list.
What to do#
Medium severity — this is a deliberate obfuscation technique.