PunycodeURL-Detector

A robust command-line tool designed to detect Punycode Homograph Phishing attacks by comparing suspicious Internationalized Domain Names (IDNs) against a target domain. It uses an extensive YAML-based homoglyph map to normalize malicious Unicode domains back to their true ASCII form, instantly revealing impersonation attempts.

---

🛡️ How It Works

Punycode attacks, or Homograph Attacks, exploit the visual similarity between characters from different writing systems (e.g., Latin 'a' and Cyrillic 'а').

1. Decoding: The script identifies Punycode (xn--) and decodes it to its original Unicode form (e.g., xn--80ak6aa92e.com $\to$ аррӏе.com).
2. Normalization: It uses the extensive similar_chars.yaml map to replace every imposter character with its correct ASCII equivalent (e.g., аррӏе.com $\to$ apple.com).
3. Verification: It compares the normalized result against the provided --target-domain to confirm if a brand impersonation has occurred.

---