{"success":true,"data":{"id":"subject-mixed-script-word","label":"Subject word mixes Latin + Cyrillic/Greek — homograph attack to defeat keyword filters","description":"The subject line contains at least one word that mixes Latin ASCII letters with characters from the Cyrillic block (U+0400–U+04FF) or Greek block (U+0370–U+03FF). This is a **homograph attack** to defeat keyword-based filters: Cyrillic `а` (U+0430) looks identical to Latin `a`, `р` (U+0440) looks like Latin `p`, `е` (U+0435) looks like `e`, `о` (U+043E) looks like `o`, and Greek `ο` (U+03BF) also looks like Latin `o`. A subject like `\"рауpal account suspended\"` reads as \"paypal\" to the human eye but tokenizes to a completely different string under NFC normalization, so a filter watching for the literal \"paypal\" misses it entirely. The detection is per-word — a subject with a Cyrillic word AND a separate Latin word is fine (legitimate multilingual signatures often mix scripts across words), only a WITHIN-word mix fires. Weight: +4 — higher than typical moderate because mixed-script-within-word is exclusively attack-shaped. No legitimate sender intentionally mixes Latin with Cyrillic or Greek inside a single word; brand names are spelled consistently in one script.","tier":"danger","category":"subject","isThin":false}}