Punycode: The invisible cyber threat hiding in plain sight

The internet was conceived to connect the world, and internationalized domain names (IDNs) have certainly helped make that vision a reality. By allowing non-ASCII characters in web addresses, they’ve been pivotal in improving both accessibility and inclusivity.

As with any technological breakthrough, cybercriminals have found a way to turn innovation into exploitation. By using Punycode, a system for encoding IDNs, attackers have been able to create their own deceptive domains to mimic trusted brands and evade traditional security defenses to fool even the most wary users.

What is Punycode?

Punycode is a method used to encode IDNs which contain non-ASCII characters, such as accented letters or characters from non-Latin scripts. Given that DNS addresses only support ASCII characters, Punycode is key to allowing certain letters to be put into a format that is compatible with the IDN system, whilst retaining the original character’s visual identity. This allows users to see domain names in their own language on websites while also enabling international access.

Characters like "é," "а," or "日" (from French, Russian, and Japanese) are examples of non-ASCII characters that can be turned into Punycode. This process converts these characters into a format the Domain Naming System (DNS) can understand. The encoded domain names begin with a special prefix, "xn--," to signal their encoded format so that, behind the scenes, the system still works with standard ASCII characters.

Here’s an example: the German city "München," contains the umlaut "ü," and is represented in Punycode as "xn--mnchen-3ya.com." Although the user sees the original "München" in their browser, the DNS system processes it using the Punycode version.

How Do Attackers Exploit Punycode?

Punycode’s ability to integrate characters from different scripts alongside standard ASCII characters is misused by threat actors in multiple ways. Attackers can exploit this feature by swapping one or two characters in a domain name with visually similar ones from other scripts.

These subtle changes are often undetectable to the human eye, so it’s incredibly easy to deceive users into visiting bad websites. This tactic is particularly effective in phishing campaigns, where attackers create domains that closely resemble those of trusted websites.

Users are often unaware of the tiny differences and therefore might unknowingly provide sensitive information like passwords or credit card numbers on these malicious sites.

Attackers also rely on Punycode to register domains that are very similar to well-known sites, hoping users will accidentally visit the wrong address and capitalize on implicit trust with popular brand names. These fake sites become nearly impossible to distinguish from the original so are an appealing method for attackers due to the high success rate.

The Challenges for Security Analysts and Traditional Defences

Even skilled SOC analysts will struggle to identify Punycode-based threats. Although Punycode-encoded URLs follow a structured pattern (typically starting with "xn--"), they can appear as seemingly random or encoded data to many security tools. While the encoded format might superficially resemble other schemes like Base64, its structured nature isn’t always recognized as a potential indicator of malicious intent by traditional, rule-based security measures.

This allows attackers to bypass automated alerts and gain additional time to deploy malware or establish persistence within compromised systems. Attackers further complicate detection by embedding these deceptive URLs within shortened links or HTML-rich phishing emails.

Legacy security solutions are particularly vulnerable to these tactics and offer no assistance to already stretched SOC teams. Secure email gateways (SEGs) and other traditional filtering systems rely on pattern recognition to identify known threats, but they often fail to decode Punycode. Given that tools such SEGs are typically built around rigid rule-based detection methods, they often miss the phonetic and visual similarities between characters from different scripts.

Since Punycode domains appear as ASCII-compatible, security systems might not be able to recognize them as potentially harmful. This allows attackers to use slight domain variations, evading static blocklists and regex-based rules that lack contextual awareness. For example, a SEG might flag a suspicious “badsite.com” domain, but fail to recognize “xn--badsite-123.com” as a threat, even if the encoded domain redirects to the same harmful site.

The dynamic nature of Punycode also means that attackers can create countless variations of deceptive domains, making it difficult for legacy security systems to keep up, giving cybercriminals more time to exploit victims before countermeasures are put in place.

Given the sheer volume of threats that analysts face daily, more advanced methods of catching these attacks are needed.

Defending Against Punycode-Based Attacks

To protect against the growing threat of Punycode-based attacks, businesses need to adopt more advanced security solutions. Legacy systems are simply no longer sufficient.

AI-native security solutions are crucial in helping to go beyond simple pattern recognition and focus more on detecting anomalies in communication behavior. Behavioral AI, for example, can identify deviations in typical communication patterns and flag suspicious activities before they can cause harm. These systems can also automatically decode Punycode domains, revealing  any malicious intent before it reaches the user.

API-based security solutions also offer a more dynamic and adaptive approach than traditional SEGs. By integrating directly with cloud email providers, these platforms continuously analyze email interactions for suspicious behavior in real time. They can detect phishing attempts instantly and are flexible enough to adapt to new attack methods as they emerge.

With these advanced technologies, businesses are better placed to handle the increasingly sophisticated Punycode attacks that threaten user security. By implementing these tools, organizations can stay ahead of attackers and ensure a higher level of protection for their users.

Embracing Modern Technology for Modern Threats

It’s clear to see how Punycode has played a key role in improving the connectivity and accessibility of the internet. Yet, with these benefits, the promise of accessibility is now being weaponized to undermine trust and security.

Traditional security measures which were built for a simpler era of threats can no longer protect against the dynamic nature of Punycode-based attacks. As the digital world continues to expand, so too must our defenses, and the same technology that gives us global connectivity should not become a backdoor for cybercriminals.

Businesses need to look to move beyond static and rule-based detection and instead embrace AI-native and API-driven security solutions. These tools can act quickly on suspicious domains in real time before they lead to compromise.

By staying ahead of threats and implementing smarter security solutions, businesses can ensure that the internet remains a place of safe and trusted communication.

Photo Credit: ArtFamily/Shutterstock

Piotr Wojtyla is Head of Threat Intel & Platform, Abnormal Security where he leads threat intelligence and platform strategy -- focusing on identifying emerging cyber threats, developing innovative solutions, and driving the integration of intelligence-driven insights to enhance cybersecurity capabilities. Prior to joining Abnormal, he served as the Senior Director for Global Security Practices and Global Incident Response for Cybereason and then as the Associate Managing Director on the SPARK (Special Projects & Applied Research) team at Kroll.