Punycode (RFC 3492) is the ASCII-safe encoding used to transmit internationalized domain names (IDNs) through DNS, which is ASCII-only. A Unicode label like münchen becomes xn--mnchen-3ya on the wire.
Structure
Punycode labels always start with xn--. Browsers convert them back to Unicode for display when the language is unambiguous.
The Phishing Vector
Because Punycode maps Unicode characters that look identical to Latin ones, an attacker can register xn--80ak6aa92e.com — which renders as apple.com using Cyrillic characters — and serve a phishing page. Browsers try to defend against this by displaying Punycode instead of Unicode when the label mixes scripts, but the defence is inconsistent.
The Canonical Incident
MyEtherWallet users lost roughly $17M in 2018 after visiting xn--e1awd7f.com — which rendered as a valid-looking crypto domain in Chrome — and entering their private keys.
Defence
- Enforce browsers’ script-restriction rules
- Register your brand’s Punycode variants defensively
- Continuously scan for lookalike registrations
Related
Check the IDN glossary entry, the homoglyph glossary entry, and read what typosquatting is.