Punycode
Punycode is the ASCII encoding (starting with xn--) of an internationalised domain name, and phishing campaigns register punycode domains that display as look-alikes of real brands.
How it works
DNS only carries ASCII, so a label with non-ASCII characters is stored as xn-- followed by an encoded form. Browsers decide whether to show the Unicode form or the xn-- form.
Attackers combine letters from different scripts so the Unicode form imitates a brand; seeing xn-- in an address bar is a reason to stop.
Example from the PhishDestroy database
- xn--mrkng10059-zub.com: Punycode phishing domain, first detected 2026-10-16.
- xn--btrefll-rfbe.com: Punycode phishing domain, first detected 2026-10-15.
- xn--pay-bitefill-ljc.com: Punycode phishing domain, first detected 2026-10-15.
How to protect yourself
- Treat any xn-- domain in a link about a known brand as hostile until checked.
- Decode it with a homoglyph checker to see the characters behind it.