Ian Muscat and Leanne Briffa of Have I Been Squatted registered 20 test domains, including аррӏө.com and oƙta.com. In Chrome 154 they display in the address bar as Unicode, not as the xn-- form that usually gives a fake away. Gmail's web app showed all 20 as normal-looking text too (The Register, Oct 10, 2026).

Those domains were built for research, not attacks. But phishing isn't slowing down: the APWG counted 971,181 phishing attacks in Q1 2026, up 13.8% from the quarter before (APWG).

So instead of trusting what the address bar shows, here's how to check a suspicious domain yourself in a few minutes. Every command below was run while writing this post, and you can run them too.

Why the browser misses it

Browsers show Unicode domain names as text only when they look safe. Chromium decides this with a list of characters it trusts and a check against popular site names.

The researchers found gaps in both. The Cyrillic ө isn't on the list, so one of them breaks the whole-script check. A letter like ƙ (k with a hook) survives the comparison, so oƙta doesn't match okta. Chrome's Safety Tips warning also skips names under five characters or with two or more changes.

A valid HTTPS padlock doesn't help either. It proves the connection is encrypted to that domain, not that the domain belongs to the brand.

Step 1: Reveal the real name

Every domain with non-ASCII characters has an ASCII form called Punycode. It always starts with xn--. Converting the name is the fastest test.

In a browser console or Node.js:

new URL('https://oƙta.com').hostname
// 'xn--ota-f6a.com'

In Python (after pip install idna):

import idna
print(idna.encode('аррӏө.com').decode())
# xn--80a6aa68c8d.com

If the real okta.com comes back unchanged and the link you got comes back as xn--..., they are different domains. аррӏө is made entirely of Cyrillic letters: a, er, er, palochka and barred o.

Step 2: Check the domain's age with RDAP

Phishing domains are often freshly registered. In Q1 2026 alone, the APWG tracked more than 500 new domains tied to one "tariff refund" scam. RDAP is the replacement for WHOIS, and it returns clean JSON. ICANN completed the move to RDAP for generic domains in January 2025, and some registrars have already switched off the old port 43 WHOIS service.

rdap.org forwards your request to the right registry, so one URL works for most extensions:

curl -sL https://rdap.org/domain/xn--ota-f6a.com \
  | jq '.events[] | select(.eventAction=="registration") | .eventDate'
# "2026-09-27T12:48:44Z"

The real okta.com was registered on June 11, 2004. A login page for a company that old shouldn't live on a domain that is one month old.

To see the registrar too:

curl -sL https://rdap.org/domain/xn--ota-f6a.com \
  | jq -r '.entities[] | select(.roles | index("registrar")) | .vcardArray[1][] | select(.[0]=="fn") | .[3]'
# Dynadot Inc

Many large brands use brand-protection registrars. okta.com uses MarkMonitor.

Step 3: Check DNS

Next, see whether the domain is live and whether it can receive email. DNS over HTTPS works everywhere curl does:

curl -s -H 'accept: application/dns-json' \
  'https://cloudflare-dns.com/dns-query?name=xn--ota-f6a.com&type=A' | jq -r '.Answer[].data'
# 104.21.8.140
# 172.67.139.133

Change type=A to type=MX to check mail. xn--ota-f6a.com has none; okta.com has two. If you have dig, dig +short A xn--ota-f6a.com gives the same answer.

A domain that resolves isn't proof of anything. But a month-old lookalike that points at a live server deserves a closer look.

All three steps in one script

Save this as checkdomain.sh. It needs python3, curl and jq:

#!/usr/bin/env bash
# Usage: ./checkdomain.sh <domain>
set -euo pipefail

input="$1"

# Step 1: the real (ASCII/Punycode) name
ascii=$(python3 -c 'import sys; print(sys.argv[1].encode("idna").decode())' "$input")
echo "Domain:     $input"
echo "Real name:  $ascii"
[[ "$ascii" == *xn--* ]] && echo "            Warning: contains non-ASCII characters (IDN)"

# Step 2: registration date and registrar from RDAP
rdap=$(curl -sfL "https://rdap.org/domain/$ascii" || echo "{}")
created=$(echo "$rdap" | jq -r '.events[]? | select(.eventAction=="registration") | .eventDate' | head -1)
registrar=$(echo "$rdap" | jq -r '[.entities[]? | select(.roles | index("registrar")) | .vcardArray[1][]? | select(.[0]=="fn") | .[3]][0] // "unknown"')
echo "Registered: ${created:-not found in RDAP}  (registrar: $registrar)"
if [[ -n "${created:-}" ]]; then
  age=$(python3 -c 'import sys,datetime as d; c=d.datetime.fromisoformat(sys.argv[1].replace("Z","+00:00")); print((d.datetime.now(d.timezone.utc)-c).days)' "$created")
  echo "Age:        $age days"
  (( age < 90 )) && echo "            Warning: less than 90 days old"
fi

# Step 3: does it resolve, and can it receive email?
for type in A MX; do
  ans=$(curl -s -H 'accept: application/dns-json' \
    "https://cloudflare-dns.com/dns-query?name=$ascii&type=$type" \
    | jq -r '[.Answer[]?.data] | join(", ")')
  printf '%-11s %s\n' "$type:" "${ans:-none}"
done

Running it on one of the research domains:

$ ./checkdomain.sh oƙta.com
Domain:     oƙta.com
Real name:  xn--ota-f6a.com
            Warning: contains non-ASCII characters (IDN)
Registered: 2026-09-27T12:48:44Z  (registrar: Dynadot Inc)
Age:        30 days
            Warning: less than 90 days old
A:          104.21.8.140, 172.67.139.133
MX:         none

Step 4: Run the deeper checks in one call

The script covers name, age and DNS. It doesn't check threat feeds, the SSL certificate or what the page actually does. For that, I use the WhoisFreaks Domain Reputation API. (Disclosure: I work at JFreaks, the company behind WhoisFreaks.)

curl -s "https://api.whoisfreaks.com/v1/domain/security?domainName=xn--ota-f6a.com&apiKey=$WHOISFREAKS_KEY"

One request runs six checks in parallel: threat-feed matches, live WHOIS (it flags domains under 30 days old), DNS, SSL, the landing page and its redirects, and a score for machine-generated names. Look at three fields in the JSON:

• risk_category.verdict: safe, low risk, suspicious or malicious
• trust_signals.trust_score: 0 to 100
• evidence_summary.why_flagged: the reasons, in plain words

Each lookup costs 5 credits, and new accounts get 500 free credits without a card. If you only check the odd link, the free script above is enough.

Step 5: If you own a brand, look for lookalikes first

Checking one link helps you. Finding lookalikes of your own name before customers do helps everyone who trusts you.

The Typosquatting API searches registered domains for typo variants of a brand name:

curl -s "https://api.whoisfreaks.com/v3.0/domain/typos?keyword=yourbrand&apiKey=$WHOISFREAKS_KEY" \
  | jq -r '.domains[] | "\(.createDate)  \(.domainName)"'

Each page of up to 100 results costs 5 credits. The free version on the WhoisFreaks site found 2,178 registered domains close to "okta". Sort by createDate and start with the newest.

One honest limit: the docs describe ASCII keywords only and don't say whether Unicode lookalikes like the ones above are included. Pair this with the researchers' own advice and watch for new xn-- registrations that resemble your name.

The pool of places to register lookalikes is also about to grow. ICANN revealed 1,615 applications for new top-level domains on October 7, 2026, and the final list of strings is due on November 17 (ICANN).

What actually protects people

Spotting fakes is a backup, not the plan. These work even when the domain looks perfect:

• Passkeys. They are tied to the real domain, so they won't work on a lookalike.
• Password managers. They won't autofill on a domain that doesn't match the saved one. Treat a missing autofill as a warning.
• Bookmarks. Open important sites from a bookmark, not from a link in a message.
• Mail filtering. Turn on impersonation protection in your mail gateway if you run one.

FAQ

Is every xn-- domain malicious? No. About 733,000 of the roughly 167 million .com domains are internationalized. The researchers found around 162,000 that resemble ASCII names, and many of those are defensive or multilingual registrations.

Do I need an API to check a domain? No. Steps 1–3 use free, public tools. An API helps when you check many domains or need threat-feed and page-content checks.

Is RDAP the same as WHOIS? It returns the same kind of registration data, as structured JSON over HTTPS. For generic top-level domains it is now the official source.

Have you seen a lookalike of a site you use? Run it through the script and share what it found in the comments.