Punycode

Punycode is an encoding, defined in RFC 3492, that represents Unicode characters using only the letters, digits and hyphens that DNS allows. It is what lets domain names contain characters such as ü, ş or Cyrillic letters. Punycode itself is normal, legitimate technology; it matters for security because it is the mechanism behind homograph attacks.

How it works

Under the IDNA standards for internationalized domain names, each part (label) of a domain that contains non-ASCII characters is converted to punycode and given the prefix xn--. A Turkish name with ö or ş, for example, is stored in DNS as an xn-- string, and that string is what certificates and DNS records refer to. Browsers and apps then decide whether to display the readable Unicode form or the raw xn-- form. Most modern browsers show punycode when a label mixes scripts or contains characters that are easily confused with Latin letters, while showing ordinary accented names normally. These policies are not identical everywhere, and email clients, chat apps and QR scanners may show the Unicode form even when a browser would not.

Example

An illustrative case: a phishing email links to what reads as examplebаnk[.]com, but one letter is Cyrillic. In DNS the domain is a string beginning with xn--. The email shows the lookalike text, while the browser address bar, if anyone checks it, may show the xn-- form. The certificate for the site, visible in public logs, is also issued to the xn-- name.

How to spot it

• xn-- appears in the address bar or link preview of a site that should have a plain ASCII domain.
• A certificate in public logs is issued to an xn-- name that decodes to something resembling your brand.
• The link text and the actual destination differ when you hover over or long-press the link.
• Your password manager does not recognize the site.

What brands can do

• Include internationalized variants in domain monitoring, and decode punycode in alerts so analysts see the visual form.
• If you operate in markets with accented or non-Latin letters, such as Türkiye, consider registering the internationalized versions of your brand.
• Watch certificate transparency logs for xn-- names that decode to your brand.
• Report active lookalikes for takedown and blocklisting.

Phishvoid decodes and checks punycode domains as part of its monitoring and takes down those used for phishing; contact the team for details. Further reading: Typosquatting and homoglyph domains explained.

Read more: Typosquatting and Homoglyph Domains Explained