# Punycode

Punycode is the ASCII encoding (starting with xn--) of an internationalised domain name, and phishing campaigns register punycode domains that display as look-alikes of real brands.

## How it works

DNS only carries ASCII, so a label with non-ASCII characters is stored as xn-- followed by an encoded form. Browsers decide whether to show the Unicode form or the xn-- form.

Attackers combine letters from different scripts so the Unicode form imitates a brand; seeing xn-- in an address bar is a reason to stop.

## Example from the PhishDestroy database

- [xn--mrkng10059-zub.com](https://phishdestroy.io/domain/xn--mrkng10059-zub.com/): Punycode phishing domain, first detected 2026-10-16.
- [xn--btrefll-rfbe.com](https://phishdestroy.io/domain/xn--btrefll-rfbe.com/): Punycode phishing domain, first detected 2026-10-15.
- [xn--pay-bitefill-ljc.com](https://phishdestroy.io/domain/xn--pay-bitefill-ljc.com/): Punycode phishing domain, first detected 2026-10-15.

## How to protect yourself

- Treat any xn-- domain in a link about a known brand as hostile until checked.
- Decode it with a homoglyph checker to see the characters behind it.

## Related tools

- [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker)
- [URL Parser](https://phishdestroy.io/developer-tools/url-parser)

## Related terms

- [Homoglyph](https://phishdestroy.io/glossary/homoglyph/)
- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)

## Further reading

- [Newly Registered Domains: Phishing Risk Guide](https://phishdestroy.io/newly-registered-phishing-domains)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/punycode/