Online Tool Store
IDN/Punycode Phishing Detector
Analyze a domain for mixed-script homoglyph tricks and reveal its punycode form to spot potential phishing links. Runs entirely in your browser.
🔒 This tool runs entirely in your browser. Your files are never uploaded to a server.
The sample above uses a Cyrillic "а" that looks identical to a Latin "a" - a classic homoglyph phishing trick.
How the IDN/punycode detector works
- Enter a domain or URL - a homoglyph example loads automatically to demonstrate the detection.
- The tool converts it to its ASCII punycode form and analyzes each label's character scripts.
- Review the verdict - domains mixing scripts like Latin and Cyrillic are flagged as suspicious.
FAQ
What is a homoglyph attack?
A phishing technique that registers a domain using letters from a different script (like Cyrillic "а" instead of Latin "a") that look nearly identical, tricking users into thinking they're on a trusted site.
What is punycode?
The ASCII-safe encoding (prefixed with "xn--") that browsers use internally to represent internationalized domain names containing non-ASCII characters.
Is every punycode domain malicious?
No - many legitimate websites in non-English-speaking regions use internationalized domain names. The red flag is specifically mixing scripts within a single label to visually mimic a well-known domain.
Does this tool check if a domain is actually registered or malicious?
No - it only analyzes the domain's character composition for suspicious mixed-script patterns. It doesn't check reputation, WHOIS data, or actual phishing databases.
How we compare
| Feature | Online Tool Store | Eyeballing the URL | Enterprise phishing filter |
|---|---|---|---|
| Reveals hidden punycode form | ✓ | ✗ | ✓ |
| Instant, no install | ✓ | ✓ | ✗ |
| Real-time threat intelligence | ✗ | ✗ | ✓ |
A quick sanity check for a suspicious-looking link before clicking, in addition to your organization's security tools.