{"success":true,"data":{"id":"subject-lookalike-char-substitution","label":"Subject contains Unicode lookalike character (homograph attack)","description":"The subject line contains at least one character from a curated set of 21 Unicode codepoints that are visually indistinguishable from ASCII Latin letters: 14 Greek uppercase letters (Α Β Ε Ζ Η Ι Κ Μ Ν Ο Ρ Τ Υ Χ — U+0391–U+03A7) and 7 Cyrillic lowercase letters (а е о р с у х — U+0430–U+0445). This is a **single-character homograph substitution attack**: a spammer replaces exactly one character in a brand name — e.g. `Ρaypal` (Greek Rho, U+03A1, for P) or `Αmazon` (Greek Alpha, U+0391, for A) or `аccount` (Cyrillic а, U+0430, for a) — so the word passes the `subject-mixed-script-word` per-word check (which requires multiple script-mixing characters in the same token) while still defeating exact-string keyword filters that look for literal \"paypal\", \"amazon\", or \"account\". The subject is normalized to NFC before scanning so composed/decomposed variants produce identical results. Detection fires on ANY single occurrence of a lookalike codepoint. Guard: the signal is suppressed for emails from known-trusted sender types (`strict_invoice`, `strict_work`, `strict_shopping`) so that legitimate business notifications are not penalised for localised display names or Cyrillic characters in their own-brand content. Weight: +4 — matches `subject-mixed-script-word` because single-char substitution is equally attack-exclusive; no legitimate sender intentionally places Greek Rho where Latin P belongs.","tier":"danger","category":"subject","isThin":false}}