Abstract: The described technology is generally directed towards homoglyph attack detection. A homoglyph attack detection service can create images of customer's protected domain names. A convolutional neural network can generate feature vectors based on the images. The feature vectors can be stored in a similarity search data store. Newly observed domain names can be compared to the customer's protected domain names, by also generating feature vectors for the newly observed domain names and conducting approximate nearest neighbor searches. Search results can be further evaluated by comparing protected domain names to newly observed domain names using a siamese neural network which applies a similarity threshold. Newly observed domain names that meet or exceed the similarity threshold can be flagged for further action.