{
  "id": 14915736,
  "title": "PunyGuard: A Chrome Extension That Blocks Every Internationalized Domain",
  "url": "https://urgent.news/2026/10/16/punyguard-a-chrome-extension-that-blocks-every-internationalized",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-16T09:02:56.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/sho7650/punyguard-a-chrome-extension-that-blocks-every-internationalized-domain-4alk"
  },
  "original_language": "en",
  "account": "A Chrome extension named PunyGuard has been developed to block all internationalized domain names (IDNs). The extension is designed to eliminate the risk of confusion arising from similar-looking domain names, particularly those in non-ASCII characters such as Cyrillic or Japanese.\n\nUpon reading an article explaining how Chrome displays internationalized domain names in their native characters, the extension's creator built PunyGuard to address this issue. The extension does not attempt to judge whether a domain looks similar to another; rather, it blocks any domain that begins with the string \"xn--\", which is the Punycode prefix for IDNs. This means that legitimate Japanese or Cyrillic domains will also be blocked by PunyGuard.\n\nThe creator of PunyGuard has a personal bias against Japanese domain names, and this conviction drove the design of the extension. Instead of relying on Chrome's fuzzy judgment algorithm for detecting similar-looking domains, PunyGuard uses a strict rule that blocks any domain with a label starting with \"xn--\". This approach eliminates the possibility of homograph attacks, where attackers exploit look-alike characters to trick users into visiting malicious sites.\n\nTo implement PunyGuard, the creator utilized Chrome's declarativeNetRequest (DNR) mechanism, registering a single rule that matches any URL containing a label starting with \"xn--\", including top-level domains in IDNs. The extension applies this rule to both top-level page navigations and embedded pages in iframes, without affecting the loading of resources like images or scripts.\n\nPunyGuard effectively blocks all IDNs, regardless of how they appear in the address bar. While legitimate Japanese domains will be blocked, the creator believes that this is an acceptable trade-off given the creator's personal stance on Japanese domain names. The extension can be found on GitHub at https://github.com/sho7650/punyguard.",
  "summary": "аррӏө.com and apple.com . Put them side by side: can you tell which one is real? All five letters in the first one are Cyrillic. Even so, Chrome 154's address bar displayed it exactly as-is. It looks identical to apple.com ( GIZMODO article ). After reading that article, I built a small Chrome extension called PunyGuard . It blocks access to internationalized domain names (IDNs), all of them, no…",
  "key_points": [
    "PunyGuard Chrome extension blocks all internationalized domain names (IDNs)",
    "Blocks domains starting with Punycode prefix \"xn--\"",
    "Creator has bias against Japanese domain names"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}