Registration
Internationalized Domain Names and Lookalike Domains
Domain names can be written in many scripts, not just Latin letters. That makes the web usable in every language, and it also lets attackers register names that look like a well-known brand but are spelled with different characters.
The short answer
An internationalized domain name (IDN) is a domain with letters outside plain ASCII, such as münchen.de. IDNA-compatible applications convert Unicode hostname labels to ASCII A-labels using Punycode. DNS wire-format labels can contain arbitrary octets (RFC 2181 section 11), but these application hostname conventions use a form that starts with xn--, for example xn--mnchen-3ya.de. Both forms name the same domain.
Most IDNs are legitimate. The risk is in names that mix scripts, or use letters from one script that look like letters from another, so that a reader sees a familiar name that is not the real one.
Unicode and Punycode
The rules for IDNs are set by IDNA2008, in RFC 5890 and the documents that follow it. Applications show the Unicode form to people and send the ASCII form, called an A-label, to DNS. Punycode, defined in RFC 3492, is the encoding that turns the Unicode label into ASCII.
Registries also decide which characters they accept in each TLD and often publish tables of allowed scripts. Many forbid mixing scripts in one label, but the rules vary, and some TLDs accept far more than others.
How lookalike domains work
Several scripts contain letters that look almost identical. The Cyrillic а (U+0430) and the Latin a (U+0061) are the classic example: pаypal.com with a Cyrillic letter is a different domain from the real one, with its own registrant, and only its Punycode form gives it away. This is called a homograph attack.
Lookalikes do not always need Unicode. Plain ASCII swaps, such as rn for m or the digit 0 for the letter o, work too. Browsers defend against the Unicode kind by showing the Punycode form in the address bar when a name mixes scripts in a suspicious way, but email clients, chat apps and printed links often do not.
What Website Recon shows
The Name Forms section of the Website Recon registration card shows the name as you would read it (Unicode) and as DNS carries it (Punycode), and lists the scripts each label uses. A name in plain ASCII is marked as having no internationalized labels.
When a label mixes scripts, or uses characters that look like ASCII letters, a Review this name box lists what was found. Website Recon also compares the name and its lookalike spellings against brands that phishing often borrows; a match on a domain the brand does not own is raised in the brand impersonation warning.
Plenty of legitimate names use more than one script, and some brands own their lookalikes defensively. Use the flag as a reason to check who registered the name and what the site does, not as proof of abuse.
Checking a suspicious name
- Compare the Punycode form with the name you expected. If the real domain is plain ASCII and this one starts with xn--, it is a different domain.
- Look at the registrar, the creation date and the registration status. A lookalike registered last week is far more suspicious than one held for years by the brand.
- Check what the homepage serves and whether it asks for a password.
- If it is impersonating a brand, report it to the host and the registrar from the Report Abuse panel.
FAQ
Are internationalized domain names dangerous?
No. Most are ordinary domains in languages that do not use the Latin alphabet. The risk comes from names designed to look like another domain.
Why does my browser show xn-- instead of the name?
Browsers show the Punycode form when a name mixes scripts or uses characters that could be confused with others. It is a deliberate caution, applied by each browser's own display rules, which differ between browsers and versions. It does not prove the name is malicious, and a name shown in Unicode is not proof that it is safe.
Can I register the lookalikes of my own domain?
Often, yes, where the registry allows those characters. Many brands register their most obvious lookalikes so that nobody else can.