Indicia

Lookalike domain & punycode checker

Convert xn-- punycode to readable text and back, and spot homograph and typosquatting tricks: mixed alphabets, Cyrillic lookalikes, brand names in subdomains and one-letter swaps.

Runs in your browser. Nothing you paste is uploaded, stored or logged.

    How it works

    Phishing domains are built to survive a quick glance: a Cyrillic letter in place of a Latin one, a zero instead of an “o”, “rn” standing in for “m”, or the real brand name placed in a subdomain of someone else’s domain. In an email client or a log line they can be impossible to tell apart from the real thing.

    Paste domains or full URLs. Each is converted between its readable form and its xn-- punycode form, every non-ASCII character is listed with its code point and script, and the name is checked for mixed alphabets, lookalike characters, one-character typos of commonly impersonated brands, brand names that appear only in a subdomain, and invisible or text-direction characters.

    Questions

    What is punycode?
    Domain names can only contain ASCII letters, digits and hyphens. Punycode is how names in other scripts, such as bücher.de, are written in that alphabet. A label starting with xn-- is the encoded form (xn--bcher-kva.de), and browsers may show the decoded name instead.
    What is a homograph attack?
    Registering a domain with characters from another alphabet that look identical to Latin letters, such as Cyrillic “а” instead of Latin “a”, so a fake domain reads exactly like the real one. The classic demonstration is xn--80ak6aa92e.com, which is “apple.com” spelled entirely in Cyrillic.
    Does a warning mean the domain is malicious?
    No. The checks look for patterns used in phishing and compare names with a list of commonly impersonated brands. Many internationalised domains are entirely legitimate, and a clean result does not make a domain safe. Look at who registered it, how old it is and its reputation too.
    Is anything looked up?
    No. Conversion and analysis run in your browser. The domain is not visited, resolved in DNS or sent anywhere, so checking a phishing domain does not alert whoever runs it.