Skip links
punycode cybersecurity

Understanding Punycode: Its Benefits and Cybersecurity Risk.

In our interconnected world, the internet needs to be accessible to everyone, regardless of language or script used in writing. Punycode is a technology that helps achieve this by allowing domain names to include non-English characters. However, while it solves one problem, it can also become a cybersecurity risk. This blog post will explain what Punycode is, how it can be misused, and how you can protect yourself from potential threats.

punycode cybersecurity

What is Punycode?

Punycode is a way to convert characters from various languages into a simpler format that the internet’s Domain Name System (DNS) can handle. This means that domain names can include characters from any language, not just English.

The Origin of Punycode

The technology behind the internet dates back to the 1960s, primarily developed by Americans. This led to ASCII (American Standard Code for Information Interchange) becoming the default encoding standard, limited to 128 characters of the Latin alphabet, numbers, and punctuation.

ASCII couldn’t encode characters from other writing systems like Kanji, Hangul, or Cyrillic, creating barriers for non-Latin readers and markets needing localized domain names.

Unicode was developed to support a wide range of characters. While ASCII is rarely used today, much old software and hardware still rely on it. To bridge modern Unicode systems with older ASCII systems, Punycode was created.

How Punycode is Used

Punycode is essential for handling internationalized domain names. For instance, Korea’s Hangul characters cannot be encoded with ASCII. Punycode converts Unicode strings, like those in Hangul, into a format that can be read and resolved using ASCII. i.e by interpreting any given string and identifying non-ASCII characters, It then performs several steps to convert the string into a format that is compatible with ASCII systems.

Before Punycode, companies and services in markets like Korea had to alter their brand names to comply with ASCII limitations. For instance, ‘과일가게’ means ‘fruit shop’ in Korean. A website would need to change its domain name to something like ‘www.fruitshop[.]co[.]kr’. Thanks to Punycode, they can now use a domain name like ‘www.과일가게’, allowing brands to maintain their authentic identities and localize their services for non-Latin alphabet markets. Punycode also supports top-level domains, enabling fully non-ASCII internet hostnames to be resolved on ASCII systems.

As an example, the string ‘과일가게’, Punycode would convert it to ‘xn--o29a98gk1yzc’. This unique string allows ASCII systems to read and interpret characters beyond the ASCII standard. ASCII systems will interpret the URL ‘www.과일가게’ as ‘’. It’s important to note that most browsers will display the Punycode result in their address bar to help prevent phishing attacks but most users miss this details, which brings us to the risks associated with punycode.

The Disadvantages: Understanding Punycode Phishing Attacks

phishing attack which is one of the most effective cybersecuity attacks can be easily utilized with punycode. Punycode phishing attacks occur when cybercriminals register domain names using Punycode encoded strings. These domains can look almost identical to well-known brands by substituting a single character with a visually similar one from a different character set. This type of attack is known as a homograph attack, where malicious actors exploit the similarity between characters from different languages to create deceptive domain names that appear legitimate.

Some Exmaples of Punycode Conversion

Latin ‘a’ (U+0061) and Cyrillic ‘а’ (U+0430)

  • Legitimate domain:
  • Malicious domain: арр (using Cyrillic ‘а’)
  • Punycode:

Latin ‘o’ (U+006F) and Cyrillic ‘о’ (U+043E)

  • Legitimate domain:
  • Malicious domain: gоо (using Cyrillic ‘о’)
  • Punycode:

By exploiting these similarities, attackers can trick users into visiting fake websites, where they might steal sensitive information like passwords or credit card numbers.

How to Spot and Avoid Punycode Attacks

1. Be Vigilant:

  • Always double-check the URL before entering sensitive information. Look closely for any unusual characters.

2. Adjust Browser Settings:

  • Most modern browsers have settings that can display Punycode URLs in their decoded form. Turning on these settings can help you spot suspicious URLs.

3. Hover Over Links:

  • Before clicking a link, hover over it to see the actual URL. This can reveal if a link uses Punycode.

4. Keep Your Browsers Updated:

  • Modern browsers like Chrome, Firefox, and Safari have built-in protections against homograph attacks. Make sure your browser is always up to date.

5. Enable Multi-Factor Authentication (MFA):

  • Even if an attacker gets your password, MFA can add an extra layer of security, making it harder for them to access your accounts. Ensure this is enabled in all your social and online platform (if available).

6. Educate Yourself and Others:

  • Regularly inform and train yourself and others about the risks of phishing and homograph attacks. Awareness is key to prevention.

7. Use HTTPS:

  • Always ensure the website you visit is implementing HTTPS, which ensures that your data is encrypted during transmission.


Punycode plays a crucial role in making the internet more accessible, but it also has the potential for misuse. By understanding the risks and taking proactive steps to protect yourself,you can navigate the web more safely.

A&D Forensics offers comprehensive vulnerability assessment and penetration testing for both startups and established businesses, helping them secure there platforms before it gets exploited by cyber-criminals. Click here and submit a request today.

This website uses cookies to improve your web experience.
On-Site Certified Cryptocurrency Investigator (CCI) Training

Learn how cryptocurrency related transactions, crimes are tracked, traced and prosecuted.

Certified Cryptocurrency Investigator Virtual Training

Learn how cryptocurrency related transactions, crimes are tracked, traced and prosecuted.


Learn how compliance could be a competitive advantage to your exchanges with all your AML, CTF, KYC and OFAC requirements.

By becoming an early bird for each cohort or leveraging our partner firms, you can obtain up to a 25% discount, contact us for more details.

Smart Contract Audit

To speak to us regarding Smart Contract Audit, please fill the form below. We will make every attempt to respond to you as soon as possible

Call Direct: +2348036180089 | +2349095503040

Get in touch

To speak with us as regards our services, to make comments and ask questions, please fill the form below. We will reply as soon as possible.

Call Direct: +2348036180089 | +2349095503040


Chioma Onyekelu is a highly skilled and accomplished professional in the field of cryptocurrency and blockchain technology. She is a Certified Cryptocurrency Investigator and Crypto Compliance Specialist, as well as a Blockchain Forensic Specialist and a teacher. She is also a public speaker and her teachings include consultations and practical solutions for African Start-ups on the best and most cost-effective way to build with compliance in mind. With a wealth of knowledge and experience in these cutting-edge technologies, she is well-equipped to navigate the complex landscape of cryptocurrency-related crimes.

In her current role as a Blockchain Forensic Specialist at A&D Forensics, Chioma is responsible for tracing and investigating cryptocurrency-related crimes, as well as training law enforcement agents and compliance officers on the latest developments and best practices in the field. In addition, she is currently pursuing a Master's degree in Blockchain and Digital Currencies at the University of Nicosia in Cyprus, further solidifying her expertise and understanding of the technology.

Chioma's dedication and passion for the field is evident in her work, and she is committed to staying at the forefront of developments in cryptocurrency and blockchain technology to provide the best possible service to her clients. Her exceptional skills in educating and consulting make her a valuable asset to the industry and an authority in the field of Blockchain and Crypto Compliance.


Adedeji is a Forensic Investigation Practitioner and CertifiedBlockchain/Cryptocurrency Forensic
Investigator (CFE, CCI, CCFI & Reactor Certified) with more than Fifteen years of experience across few banks within the Nigeria Financial Sector and educator in Corporate workplace settings, Deji is uniquely qualified and involved in forensics analysis of Financial Infractions, Cryptocurrency crimes and designing plans that works for Government, Regulators, Law enforcement.

He was appointed by SEC Nigeria as Member Virtual Asset and Fintech Regulatory framework drafting Committee, He is a member of Global Digital Finance’s KYC/AML working group in France and a member of the Industry led Thinktank that worked on and came out with FATF cryptocurrency Travel rule InterMessaging Standard for Virtual Assets (IVMS101) to help combat money laundering and terrorism financing using cryptocurrencies around the globe.

His law enforcement training efforts on new money and cybercrime have seen him train many law enforcement agents in various countries i.e Nigeria Police, Nigeria Army CyberWarfare command, Zambia Financial Intelligence Unit, Zambia Central Bank and more.
He is Chainalysis Sole Africa Investigative Partner helping law enforcement investigate criminal organizations using cryptocurrency to conceal illiccit activities across Africa, he is also a training Partner for Blockchain Intelligence Group based out of Canada.

Cryptocurrency Investigation Training

Learn how cryptocurrency related transactions, crimes are tracked,
traced and prosecuted.