IDN Homograph Visual Similarity Matrix
Inspect Unicode confusable attack surfaces. Detect deceptive mixed-script lookalikes across Cyrillic, Greek, and Latin alphabets, decode Punycode ACE labels, and simulate browser address bar defense.
Detected Confusable Permutations
| Visual Appearance | Substituted Script | Unicode Codepoint | Browser Display | Punycode ACE Form |
|---|
Frequently Asked Questions
What is an IDN homograph attack and why does it succeed against human eyes?
An IDN homograph attack occurs when an attacker registers a domain name containing non-Latin Unicode characters that look identical or nearly identical to standard Latin letters (e.g. Cyrillic Small Letter "а" U+0430 looks identical to Latin "a" U+0061). To a human reader, the domain looks identical to a trusted brand, but resolves to the attacker server.
How do modern web browsers defend against homograph spoofing?
Browsers implement Unicode Technical Standard #39 security mechanisms. If a domain contains mixed scripts (such as blending Cyrillic and Latin characters) or uses scripts uncommon to the user locale, the browser address bar displays the raw Punycode ACE representation (e.g. xn--pple-43d.com) instead of the deceptive Unicode characters.
What is Punycode (RFC 3492) and how does it represent IDNs in the DNS?
Because the core DNS system historically supports only ASCII alphanumeric characters and hyphens, RFC 3492 defines Punycode, an encoding algorithm that transforms arbitrary Unicode strings into ASCII-compatible strings prefixed with "xn--".
Which character scripts are most frequently exploited in homoglyph phishing?
Cyrillic (sharing identical glyphs for a, c, e, o, p, s, x, y) and Greek (sharing glyphs for o, v, i, p) are the most heavily abused scripts for Latin-lookalike homograph phishing vectors.