Fake Domain Detector (Punycode)
Find out if a domain uses characters imitating Latin letters to impersonate another. Decode xn--, analyze alphabets and estimate the risk.
Try real suspicious domains you received by email. Analysis is 100% local.
Likely dangerous
Characters mimicking Latin letters detected. Verify the domain character by character before trusting it.
xn--80ak6aa92e.com
аррӏе.com
Detected signals
Non-Latin alphabets present: cirílico
Homoglyphs found (char → Latin letter it mimics):
Punycode per label
The implemented Punycode encoding is validated against all 19 official test vectors from RFC 3492, the standard defining xn-- domains.
Built by
Miguel Ángel Colorado Marin (MACM)
Built by
Miguel Ángel Colorado Marin (MACM)
Full-Stack Developer · Guadalajara, España
I develop web apps, digital tools and full projects — from design to deployment.
The IDN homograph attack registers a domain that fools the human eye: "аpple.com" with a Cyrillic first «а» reads exactly like the original but points to a different server. Browsers show such domains as xn--80ak6aa92e only when they mix alphabets suspiciously; otherwise they trust your eyes. This detector disarms the trap: it decodes every punycode label with an own implementation validated against the official RFC 3492 vectors, walks the real Unicode domain character by character, flags homoglyphs (which Latin letter each one mimics) and classifies risk by combining punycode presence, non-Latin alphabets and mixed scripts. Use it before clicking any banking or corporate link received by email.
Features
- ✓xn-- decoding with the full RFC 3492 implementation
- ✓Cyrillic, Greek and related homoglyph detection
- ✓Low / caution / danger risk classification
- ✓ASCII vs real Unicode views side by side
- ✓100% local analysis, no external DNS lookups
How do I detect a fake domain?
- 1
Copy the suspicious domain
From the email link, without https:// or paths.
- 2
Analyze it here
The detector shows its real Unicode form and its punycode.
- 3
Review the signals
Homoglyphs, odd alphabets and the estimated risk level.
- 4
Compare character by character
Against the legitimate domain letter by letter before trusting it.
Frequently asked questions
What does the xn-- prefix mean?
It's the official marker that a domain label contains non-basic-ASCII characters, encoded as Punycode per RFC 3492. Every internationalized domain (ñ in .es, Cyrillic in .eu…) carries it underneath when DNS requires it.
Is a punycode domain always malicious?
No: legitimate internationalized domains (bücher.es, España.com) use punycode legally. The danger signal is the combination: punycode + Latin-mimicking letters + imitation of a known brand name.
Does the tool query the domain anywhere?
Never. Analysis is purely textual inside your browser: no DNS, no whois, no requests toward the analyzed domain.
Related tools
Embed Punycode Domain Checker on your site
Add Punycode Domain Checker to any web page with a simple iframe. Free, with attribution to miguelacm.es.
<iframe
src="https://miguelacm.es/embed/punycode-checker"
width="100%"
height="700"
frameborder="0"
title="Punycode Domain Checker — miguelacm.es"
></iframe>