IDN Homograph Purple-Team Kit

Two small Python tools for studying and defending against IDN homograph ("writing clone") domain attacks, where a lookalike domain uses non-Latin characters that render like a trusted brand (for example Cyrillic ө in аррӏө.com imitating apple.com).

Purpose

For educational use and authorized security research only. Use it on domains you own or are explicitly permitted to assess. It generates and inspects lookalike names, resolves DNS, and reads public Certificate Transparency logs. It registers nothing, sends no mail, and changes nothing.

The tools

impostor.py (generator)

Takes a domain and generates homograph lookalikes, shows each one's Punycode (xn--) form, and estimates whether an updated Chromium browser would display it as Unicode (a convincing clone) or fall back to Punycode.

python impostor.py apple.com
python impostor.py yourbrand.com --unicode-only

domain_defender.py (scanner)

Takes a domain you own, generates the high-risk clones, then checks which are already registered, which are email-capable (have MX records, so ready to send phishing), and optionally which have certificates. Outputs a prioritized worklist and a CSV.

python domain_defender.py yourbrand.com --certs --csv worklist.csv

Each clone is triaged as:

• REGISTERED + EMAIL highest risk, ready to phish
• REGISTERED live but no mail yet
• CERT ONLY certificate issued but no DNS yet, likely being staged
• available not found, consider registering it yourself

How to defend (what the output points you to)

1. Report registered clones to the registrar and host, and submit them to Google Safe Browsing and Microsoft SmartScreen.
2. Defensively register the dangerous unregistered spellings.
3. Use passkeys / FIDO2 so a stolen login on a clone site is useless.
4. Set DMARC to p=reject and tag inbound mail from xn-- senders.
5. Re-run on a schedule and watch Certificate Transparency logs.

Notes and limits

• The browser verdict is a heuristic that approximates Chromium's logic, not a substitute for a real browser. Chromium's behavior also changes between versions. Always confirm a candidate in a current browser.
• available means no DNS or cert was found right now, not that the name is unregistered at the registry. Check WHOIS / RDAP for authoritative status.
• Space out requests with --delay to avoid hammering resolvers or crt.sh.

Credit

The techniques here are based on the research "Turning IDN edge cases into typosquats" by Ian Muscat and Leanne Briffa (Have I Been Squatted). All credit for the original analysis of Chromium's IDN display checks, the Cyrillic "breaker" characters, and the Latin hook behavior goes to them. These scripts are an independent educational reimplementation of the ideas in that paper.