IDN Homograph Detector

Domain names were once limited to the ASCII letters, digits and hyphen, and then the internet became multilingual. Internationalised domain names let a business register a name in its own language, which is good. They also created a risk: the Cyrillic letter “а” (U+0430) looks exactly like the Latin “a” (U+0061) in most fonts. An attacker who registers paypаl.com with the Cyrillic letter has a name that a person cannot tell apart from the real one by eye. This is a homograph attack, and this page shows what is hiding in a name.

How a name is checked

Each name is split into labels, the parts between dots, and every character is looked up. The page reports the script of each label (Latin, Cyrillic, Greek and so on), lists characters from a table of known look-alikes with their code points and the Latin letter they imitate, and builds a skeleton in which every look-alike is replaced by its Latin twin. Comparing that skeleton with a list of well-known brands shows what the name is trying to be.

A worked example

The sample has five lines. The first, аррӏе.com, is written entirely with Cyrillic letters: а (U+0430) looks like a, two р (U+0440) like p, ӏ (U+04CF) like l, and е (U+0435) like e. The page shows its punycode form xn--80ak6aa92e.com, the skeleton apple.com, and the verdict “Dangerous: looks like a well-known brand”. paypаl.com mixes Latin letters with one Cyrillic а and becomes xn--paypl-7ve.com, with the skeleton paypal.com; mixed scripts in one label are flagged separately. münchen.de has no look-alike characters and a punycode form of xn--mnchen-3ya.de, and example.com is plain ASCII. The third sample line is the punycode form of the first, which the page decodes back to the same Cyrillic name and rates the same way.

Punycode in two lines

Domain names on the wire are ASCII only. A name with other letters is converted by an algorithm called punycode into a label that starts xn--. The browser decides whether to show the Unicode version or the punycode one. Looking at the punycode is a reliable test: a name that is supposed to be a familiar English brand but arrives as xn-- followed by odd characters is not what it seems.

Whole-script look-alikes

The hardest case is a label written wholly in one non-Latin script that happens to resemble a Latin word, as аррӏе does. It has no mixed scripts, so rules that only look for mixtures miss it. That is why this page shows each confusable character and the Latin skeleton, and why browsers keep adding rules.

Using it in practice

Check any link in a message that asks for credentials, especially when the address bar shows an unfamiliar encoded name. Security teams can paste a list of newly registered domains. Brand owners can check their own names before registering variants, and generate other typos with the typosquatting tool.

Limits

The table of confusables covers the most common characters and not the whole Unicode list, and the brand list is short, so a clean result is not a guarantee. The page does not query registrations, reputation or certificates. It works offline in your browser.

Related tools

• Punycode Converter converts between Unicode and xn– forms.
• Typosquatting Domain Generator lists typo and look-alike variants of your own name.
• Zero-Width Character Detector finds invisible characters in text.
• URL Defanger makes suspicious links safe to share.