Red Siege revisits the classic IDN homograph attack and shows how attackers route around modern registrar language requirements by simply selecting the appropriate language pack. The trick still works because Punycode is just an ASCII encoding of Unicode, and plenty of apps (Slack, looking at you) happily render the spoofed Unicode form rather than the encoded one. Browsers are only a partial safety net: Chrome’s IDN display policy falls back to Punycode for mixed scripts, whole-script confusables and lookalikes of top domains, so a single accented letter in a lesser-known name like Red Siege’s “rędsiege.com” can still show up as Unicode. Defenses are unglamorous but effective: enforce Punycode display in browsers, filter incoming mail by character set, and monitor DNS for substitution patterns (still ignored by most, somehow).
