IDN Punycode Detector to Spot Homograph Phishing Domains

A link can look perfectly familiar and still lead somewhere else. Attackers register domain names that use characters from other alphabets which happen to look like Latin letters, so a name that reads as a well known brand in the address bar is actually a different domain entirely. The IDN Punycode Phishing Detector examines such domains and identifies homograph attacks built on Punycode and Unicode characters, helping you decide whether an internationalised domain name is what it claims to be before you trust it.

How Internationalised Domains Work

The domain name system was built on plain ASCII characters, yet most of the world's languages use other scripts. Internationalised Domain Names solve that by allowing Unicode characters in a name, and Punycode is the encoding that translates those Unicode names into the ASCII form the DNS can store, recognisable by the xn-- prefix at the start of a label. A legitimate example is a business whose real name contains accented letters or a non Latin script, serving its local audience in their own language.

The same mechanism enables homograph attacks. Cyrillic, Greek, and other scripts contain letters that are visually almost identical to Latin ones, such as a character that looks exactly like the letter a but has a completely different code point. A domain assembled from those lookalikes displays as a familiar name while resolving to an attacker's server, where a convincing copy of a sign in page can harvest credentials. The deception lives in the characters themselves, which is why visual inspection alone fails.

Features of the IDN Punycode Detector

• Character level analysis: the domain is examined by its underlying characters and scripts, not by how it merely looks on screen.
• Mixed script detection: names that combine alphabets in a way that imitates a Latin brand are highlighted as a risk signal.
• Punycode form revealed: the encoded xn-- version of the name is exposed, making the true registered domain visible.
• Works on pasted links: paste the address exactly as received, preserving the deceptive characters a retype would destroy.
• Evidence for decisions: findings give security staff something concrete to show colleagues instead of a gut feeling about a link.

How to Use the IDN Punycode Detector

1. Copy the suspicious domain or link exactly as you received it, without retyping it, since retyping would replace the deceptive characters with honest ones.
2. Paste the domain into the detector and click Analyze Domain.
3. Read the findings, paying attention to any report of mixed scripts, lookalike characters, or a Punycode form beginning with xn--.
4. Compare the decoded characters with the genuine domain you expected, letter by letter if necessary.
5. If anything is flagged, do not sign in or download from the address; navigate to the real service by typing its known address yourself or using your own bookmark.
6. Report the message or link through your mail provider's phishing tools if it arrived unsolicited.

Who Benefits From Checking

Anyone triaging a suspicious message uses this check directly: the unexpected password reset email, the delivery notice with a slightly odd link, the invoice from a supplier whose name looks right. Security and IT staff reviewing reported messages get a quick, evidence based answer instead of an opinion, and can explain to colleagues exactly which characters were substituted. Our companion tools work in the opposite directions for legitimate names: the Punycode to Unicode converter decodes an xn-- name for reading, and the Unicode to Punycode converter encodes a genuine international name for registration or configuration.

Domain owners also have a defensive reason to understand the technique. Knowing that lookalike registrations are possible prompts brands to monitor for them and to teach customers that genuine communications will never depend on a lookalike address. Checking a flagged domain against a broader safety service such as our safe browsing checker adds a second opinion about whether the destination is already known for harm.

Imagine an employee receives an email asking them to review a document, signed with the name of a file sharing service they use daily. The visible link text and the address in the status bar both appear to spell the service's name correctly. Pasted into the detector, however, the domain tells another story: one of its letters is not the Latin character it resembles but a Cyrillic equivalent with a different underlying code point, and the name's encoded form begins with the tell tale prefix. The domain is therefore not the service's domain at all, despite looking identical on screen. The deception survives screenshots, survives reading the address aloud, and survives careful eyeballing, because the human visual system is precisely what the attack exploits.

Staying Safe From Lookalikes: Tips, Limits and Mistakes to Avoid

Stay clear headed about results in both directions. A domain containing Unicode is not automatically malicious: internationalised names are a normal, necessary part of the web for millions of legitimate organisations, and the detector's job is to highlight risk signals, such as scripts mixed in a way that imitates another name, rather than to declare every non ASCII name guilty. Conversely, a clean result on the domain does not certify the page behind it; a phishing site can sit on a plain ASCII domain too, so keep judging the message's content, urgency, and requests as you normally would.

Remember that not every deceptive address uses international characters. Attackers also register names with ordinary letters transposed, a missing character, or an extra word, relying on haste rather than character level trickery, and others place a trusted name inside a longer address as a subdomain of a domain they control, so the familiar word appears while the real destination is elsewhere. Reading an address from the right, identifying the actual registered domain at its end, catches that pattern. Shortened links hide the destination altogether until followed, and display text in an email can say anything regardless of where the link leads, which is why checking the actual address matters more than the visible wording. Build the habit around the check: arrive at sensitive accounts through your own bookmarks, and treat unexpected links as unverified until examined.

Frequently Asked Questions About Punycode and Homograph Attacks

What does the xn-- prefix in a domain mean?

It signals a Punycode encoded label: an internationalised name translated into the ASCII form DNS requires. Many such names are legitimate, belonging to organisations with non Latin names, but the prefix is worth noticing when a name is impersonating a brand that normally uses plain letters.

Can I spot a homograph domain just by looking at it?

Reliably, no. The attack depends on characters that are visually indistinguishable from Latin letters, so the address bar can show what appears to be the correct name. Detection requires examining the underlying characters and their scripts, which is what this tool does.

What should I do if a domain is flagged?

Do not enter credentials, payment details, or downloads on that site. Close the page, reach the genuine service through an address you type or bookmark yourself, and if you already entered details there, change the affected password from the real site and watch the account for unusual activity.

Are all internationalised domain names suspicious?

No. They are the normal way organisations with accented or non Latin names exist on the web, and most are entirely legitimate. Suspicion is warranted when the characters are mixed to imitate a different, familiar brand, which is the pattern the detector highlights.

Why does copying the link matter so much?

Because the deception is stored in the characters themselves. Retyping the address from what you see replaces lookalike characters with the genuine Latin letters your keyboard produces, pointing you at the real domain and destroying the evidence. Always copy and paste the address as received.

Does a clean result mean the site is safe?

It means the domain shows no sign of character level impersonation. The page behind any domain can still be dishonest in ordinary ways, so keep your usual judgement about the sender, the message, and what it asks you to do.

Trust Characters, Not Appearances

The IDN Punycode Detector answers the one question your eyes cannot: whether the characters in a domain are really the ones they appear to be. Paste suspicious addresses in before you trust them, act on what the characters reveal, and a whole class of lookalike phishing loses its power over you and your team.