trailofbits/deceptiveidn — explained in plain English
Analysis updated 2026-07-25 · repo last pushed 2017-05-08
Detect phishing domains that mimic well-known brands using lookalike characters from other alphabets.
Screen newly registered domains for visual deception before they reach end users.
Automate brand-protection workflows by flagging domains that visually imitate a company's web address.
| trailofbits/deceptiveidn | albertaworlds/japanese-corpus-syntactic-analysis-agent | blue-pen5805/comfyui-krea2-negpip | |
|---|---|---|---|
| Stars | 61 | 61 | 61 |
| Language | Python | Python | Python |
| Last pushed | 2017-05-08 | — | — |
| Maintenance | Dormant | — | — |
| Setup difficulty | moderate | hard | moderate |
| Complexity | 3/5 | 4/5 | 2/5 |
| Audience | ops devops | researcher | general |
Figures from each repo's GitHub metadata at analysis time.
Requires an OCR engine dependency and likely a rendering backend, plus Python environment setup.
Deceptive IDN is a tool that spots fake website domains designed to trick people into thinking they're visiting a legitimate site. Scammers use internationalized domain names, which allow non-Latin characters like Cyrillic or Greek letters, to create lookalike addresses where a character that appears to be a Latin "e" or "a" is actually a different letter from another alphabet. To the human eye, the domain looks correct, but it's pointing somewhere malicious. The tool works by treating each domain name as a visual puzzle rather than just text. It renders the internationalized domain so it looks like an image, then uses optical character recognition (the same technology that extracts text from scanned documents) to "read" what the domain looks like. If the visual reading differs from the actual registered domain, it flags the domain as deceptive and lists what a person's eyes would likely interpret it as. Security teams, anti-fraud groups, and brand-protection specialists would find this most useful. For example, if a phishing campaign registers a domain that visually mimics a well-known brand like "epic.com" using Cyrillic characters, this tool can automatically detect the deception and identify the real domain the scammer is targeting. It helps catch lookalike domains before they reach end users. What's notable is the approach itself: instead of maintaining lists of which international characters look like which Latin characters, it leans on computer vision to simulate how a human would actually see the domain. The README doesn't go into detail on accuracy or limitations, so users would need to test it against their own cases to gauge how reliably it catches less obvious lookalikes.
A tool that detects fake website domains by rendering them as images and using optical character recognition to see what the domain looks like to a human eye, flagging mismatches as deceptive.
Mainly Python. The stack also includes Python, OCR.
Dormant — no commits in 2+ years (last push 2017-05-08).
Setup difficulty is rated moderate, with roughly 30min to a first successful run.
Mainly ops devops.
This repo across BitVibe Labs
double-check against the repo, no cap.