{"success":true,"data":{"id":"mixed-script-domain","label":"Mixed-script domain label — homograph attack (Latin + Cyrillic/Greek in one label)","description":"Sender domain has a label mixing ASCII Latin letters with characters from another script (Cyrillic, Greek, Cherokee). This is the classic homograph attack signature — attacker registers a domain like \"pаypal.com\" where the `а` is Cyrillic (U+0430) but the other letters are Latin, visually indistinguishable from \"paypal.com\". Legitimate IDNs always use a single script per label (all-Cyrillic, all-Greek, all-Japanese). Complementary to the `punycode-domain` signal, which catches the same attack when the domain is punycode-encoded (xn--); this one catches it when the domain reaches us in raw Unicode form.","tier":"danger","category":"other","isThin":false}}