Homoglyph and punycode domains, explained

Two kinds of homoglyph

A homoglyph is a character that looks like another one. A homoglyph domain uses that to copy a real name without copying it exactly. There are two ways to do it, and they behave very differently.

ASCII lookalikes use only ordinary letters and digits: rn for m, vv for w, 0 for o, 1 or l for i, cl for d. Any registrar sells them, every browser displays them as typed, and there is nothing technical to detect. Only the shape of the name gives them away.

Unicode lookalikes, usually called IDN homographs, use characters from outside ASCII: a Cyrillic а that is pixel-identical to a Latin a, a dotless ı, an é where the brand has e. They are registered and resolved in an encoded ASCII form that starts with xn--, and whether a person ever sees the disguise depends on the software showing the link.

Of the 1,235 homoglyph lookalikes of public brands Greyphish first saw in the 90 days to 1 October 2026, 965 (78%) were plain ASCII and 270 were punycode. The ASCII kind is the everyday problem; the Unicode kind is rarer and gets the headlines.

ASCII homoglyphs in the wild

These were first seen in certificate logs in the last week of September 2026 and were registered when checked. Many are years old, and some may belong to the brands themselves or to domain investors; the list says only that each one is registered and resembles the name on the right.

The m/n and rn/m swaps are worth singling out. At the font size of an email client on a phone, rnicrosoft[.]com and microsoft[.]com are indistinguishable for most readers, and no browser warning will ever fire because nothing about the name is unusual.

What xn-- means

DNS only carries letters, digits and hyphens. To allow names in other scripts, the IDNA standard encodes each non-ASCII label with Punycode (RFC 3492) and prefixes it with xn--. The registry, resolvers and certificate logs all see the encoded form; the Unicode form exists only on screen.

You can decode one in a terminal:

python3 -c 'print("xn--strpe-1sa.com".encode().decode("idna"))'
# strípe.com

Punycode is not suspicious by itself. Millions of legitimate domains in Arabic, Chinese, Cyrillic, Greek and accented Latin use it. What matters is whether the decoded name imitates a name that someone already trusts.

Registered IDN lookalikes from the last 90 days

Each of these was registered when checked. The Unicode column is how a browser or mail client may display it.

Two patterns stand out once registration data is added:

• Bulk sets. Seventeen accented variants of tesla.com were created on the same day in June 2026 through a single registrar, then picked up certificates in the second half of September. Thirty-two variants of rolex.com (ŕolex, řolex, ŗolex and so on) were created between 2018 and 2020 at one registrar and appeared in certificate logs within four days of each other in September 2026.
• Defensive holdings. strípe.com was registered in 2017 through SafeNames, a brand-protection registrar, which points to a defensive registration rather than an impersonator.

The creation date and registrar decide which pile a finding belongs in. That is why every Greyphish finding carries them, and why the lookalike search guide says to check ownership before reporting anything.

When the disguise is visible

Browsers decide per name whether to show Unicode or fall back to xn--, and the rules differ:

• Chrome shows punycode when a label mixes scripts in ways real names rarely do, when a name made entirely of Cyrillic letters could pass for Latin, and when the name's visual skeleton matches a popular domain. It can also show a "Did you mean" warning for navigations to names that look like sites you visit.
• Firefox shows Unicode when a label stays within one script (plus a few allowed combinations) and punycode otherwise. Setting network.IDN_show_punycode to true in about:config or by enterprise policy makes it always show punycode.
• Safari applies its own list of allowed scripts and shows punycode for the rest.

The gap is accented Latin. tēsla.com is single-script Latin, so mixed-script rules do not apply, and only a popular-domain check stands between it and the address bar. Brands that are not on those lists get no protection from that check. Email clients, chat apps and SMS previews have their own rendering and often show the Unicode form with no warning at all. Test the clients your customers and staff actually use, because behaviour changes between versions.

How to find homoglyph lookalikes of your domain

dnstwist generates both kinds. Restrict it to the relevant fuzzers to keep the output readable:

dnstwist --fuzzers homoglyph,cyrillic --registered yourcompany.com

The output lists the xn-- form for Unicode variants. Checking what is registered is only half of it, because new ones keep appearing; a certificate log stream will show them as they are issued. The catch is that a CT search for your name will not find them, since the logs hold the encoded form. You have to decode each new name and compare its look-alike skeleton (Unicode's UTS #39 confusables data defines one) with yours.

Greyphish does that comparison on every new certificate and registration. Its confidence score is measured after look-alike characters are replaced with the letters they imitate, so an invisible swap scores as a near-exact copy while a visible edit scores lower. One domain is watched free, with a daily digest.

Defences that actually help

• Passkeys and FIDO2 keys. They are bound to the real domain and will not sign in on a lookalike, however good it looks. This is the strongest fix for credential phishing of any kind.
• Password managers. Autofill keys on the exact domain. When a manager does not offer your password, that is the warning.
• Force punycode where you control the browser. Firefox's policy is one setting; for others, rely on the built-in checks and keep browsers updated.
• Register the obvious few. The handful of single-character swaps of your main domain on your main TLD are cheap. Registering every Unicode variant is not possible.
• Monitor and act on the ones with evidence. A homoglyph with mail records or a live login page is worth a report. The takedown guide covers how.

Questions