Punycode & IDN Homograph Phishing Detector
Unmask deceptive IDN homograph spoofing domains, punycode xn-- URLs, and lookalike Cyrillic characters in real time.
--
--
Character Script Breakdown & Lookalike Analysis
| Glyph | Code Point | Unicode Script | Status |
|---|
How Homograph Phishing Attacks Bypass Human Detection
In 2017, security researcher Zheng Xudong demonstrated that by registering the punycode domain xn--80ak6aa92e.com, standard web browsers displayed it as apple.com because all letters were valid Cyrillic characters.
Modern browsers implement mixed-script mitigation heuristics, but malicious actors continue to exploit subtle lookalikes in spear-phishing emails, SMS smishing campaigns, and rogue OAuth app redirects.
Frequently Asked Questions
What characters are most commonly spoofed?
Cyrillic characters 'а', 'с', 'е', 'о', 'р', 'х', 'у' and Greek characters 'α', 'ο', 'ν' are nearly indistinguishable from their Latin counterparts 'a', 'c', 'e', 'o', 'p', 'x', 'y'.
How can I protect my organization against homograph domains?
Defensively register common IDN variants of your high-value brands, enforce punycode viewing mode in endpoint browsers, and deploy mail filters that flag inbound URLs containing mixed unicode scripts.