How to Spot a Punycode Phishing Domain

A link looks completely legitimate in your browser’s address bar — the right brand name, correct-looking domain — and yet something about the email or message around it feels off. This is one of the more sophisticated phishing techniques: using look-alike characters from other alphabets (a Cyrillic “а” that looks identical to a Latin “a,” for instance) to register a domain that displays as visually indistinguishable from a real one, while actually pointing somewhere entirely different.

This works specifically because internationalized domain names (IDNs) support non-Latin scripts, which is a legitimate and necessary feature for a global internet — but it also means an attacker can mix characters from different scripts that happen to render identically in most fonts, and browsers don’t always flag that mixing clearly.

What punycode and homoglyph attacks actually are

Punycode is the encoding that lets internationalized domain names (which can include non-ASCII characters) work within the ASCII-only domain name system — a domain like “аpple.com” (with a Cyrillic а) actually gets encoded as something like “xn—pple-43d.com” behind the scenes. A homoglyph attack exploits the fact that certain characters from different scripts are visually identical or nearly identical, registering a domain that looks like a trusted brand’s domain to a human eye while actually being a completely different domain to the browser and DNS system.

Revealing a domain’s punycode form exposes the trick immediately — a legitimate domain and a homoglyph-spoofed lookalike will have very different punycode representations even if they render identically as normal text, which is exactly the mismatch a detector is checking for.

Why people get stuck here

• Visually identical characters are genuinely indiscriminable to the eye. Certain Cyrillic, Greek, and Latin characters render identically or nearly identically in most fonts, which is the whole point of the attack.
• Browsers don’t always flag mixed-script domains clearly. Some browsers show warnings for certain suspicious script mixes, but coverage and thresholds vary, and it’s not a guarantee.
• Trust cues elsewhere reinforce the deception. A convincing email, a correctly-styled landing page, and a domain that looks right together create a strong illusion of legitimacy.
• Manually checking a domain’s punycode isn’t something most people know how to do. Even security-conscious users don’t typically know to check a domain’s underlying encoding, since it’s not something browsers surface by default in most cases.

What a good punycode phishing detector looks like

Reveals the domain’s actual punycode encoding

Showing the underlying xn-- encoded form makes a homoglyph substitution immediately visible, since a spoofed domain’s punycode looks nothing like the legitimate domain’s.

Flags mixed-script domains specifically

Detecting when a domain combines characters from different scripts (which legitimate domains rarely do) is a strong signal worth surfacing directly, since it’s the core mechanic behind this attack.

Works on a domain you paste, not just ones you already suspect

Since the whole danger is that these domains look fine at a glance, being able to quickly check any domain — not just ones that already feel suspicious — is what makes the tool actually useful as a habit.

Common mistakes to avoid

• Trusting a domain’s visual appearance alone, especially in an email or message where you can’t easily inspect the underlying link.
• Assuming your browser will always warn you about mixed-script domains — coverage and warning thresholds vary and aren’t a complete guarantee.
• Clicking a link based on surrounding context (a convincing email, a familiar-looking layout) without separately verifying the actual domain.
• Not checking a domain’s punycode form when something about a link feels slightly off, even if you can’t immediately articulate why.
• Assuming this attack is rare or theoretical — homoglyph and punycode-based phishing domains are an active, ongoing technique, not a purely hypothetical risk.

How to do it with IDN/Punycode Phishing Detector

Online Tool Store’s IDN/Punycode Phishing Detector analyzes domains entirely in your browser.

1. Open the IDN/Punycode Phishing Detector tool.
2. Paste the domain you want to check.
3. Review its revealed punycode encoding and any mixed-script warnings.
4. Treat a flagged domain as a strong reason not to click, even if it looked completely normal.

Because it runs locally, you can check a suspicious link before ever navigating to it.

Frequently asked questions

Why can’t I just tell a spoofed domain apart by looking at it?

Because homoglyph attacks specifically exploit characters that render identically or nearly identically to the human eye across different scripts — that’s the entire mechanism of the attack, and it’s not a matter of looking more carefully, since the visual difference genuinely doesn’t exist in most fonts.

Does every internationalized domain name indicate a phishing attempt?

No — IDNs are a legitimate, necessary feature supporting non-Latin scripts for a genuinely global internet. The red flag isn’t IDN usage itself, but specifically mixing characters from different scripts in a way that mimics an existing well-known domain.

What should I do if a domain is flagged as suspicious?

Don’t navigate to it or enter any information — instead, navigate to the legitimate site directly by typing the known correct address or using a trusted bookmark, rather than following the suspicious link at all.

Final thought

A homoglyph phishing domain is specifically designed to defeat a visual check — verifying the underlying punycode encoding is one of the few ways to actually catch what your eyes can’t.

Try the free IDN/Punycode Phishing Detector tool