IDN Punycode (xn--) Homograph Attack & Spoofing Detector (2026)

An Internationalized Domain Name (IDN) homograph attack is a social engineering technique where an attacker registers a domain using non-Latin Unicode characters (such as Cyrillic 'а' U+0430, 'е' U+0435, 'о' U+043E, or Greek 'ο' U+03BF) that look pixel-identical to standard ASCII Latin letters.

Because the core Domain Name System (DNS) historically only supports ASCII characters (A-Z, 0-9, and hyphens), RFC 3492 defines Punycode (Bootstring encoding). Any domain label containing non-ASCII characters is prefixed with 'xn--' followed by the ASCII characters and encoded delta offsets of the Unicode codepoints.

Early browser defenses only blocked 'mixed-script' labels (combining Latin and Cyrillic inside the same word). Security researcher Xudong Zheng demonstrated that by writing 'apple' using 100% Cyrillic characters (а-р-р-ӏ-е), browsers treated it as a legitimate single-script Cyrillic word and rendered 'apple.com' in the URL bar.

UTS #39 defines a 'skeleton' algorithm: it normalizes strings via NFD decomposition, maps every character through the Unicode confusables table to a canonical prototype glyph, and re-applies NFD. If two distinct strings produce the exact same skeleton, they are visually confusable.

Organizations should monitor Certificate Transparency (CT) logs for 'xn--' certificates matching their brand skeleton, block newly registered IDN lookalikes at the Secure Email Gateway (SEG) and DNS resolver level, and adopt FIDO2/WebAuthn passkeys which bind cryptographically to the exact ASCII RP ID (never falling for visual spoofing).