Some more silly Punycode domain names
You know how it is, you buy one silly domain name and then you get an idea for loads more! A few weeks ago, I got https://⏻.ga/ - I think I'm the first person to get a domain name which uses a glyph from the Miscellaneous Symbols Unicode block. How exciting!
And that got me wondering… what other abuses of the Punycode algorithm can I whack into DNS? Well, here's some I whipped up using FreeNom - they offer free domain names on the .ga TLD (and a few others) and are very liberal in accepting Punycode domains.
There's millions of domains all under one roof
For some reason, the children's retailer "Toys 'R' Us" uses a backwards R in their logo. Presumably because they think kids are stupid and don't know how to form letters.
Or, maybe they're big fans of the reversed letter ᴙ? Either way, Punycode supports that!
I present to you:
Yup! Copy and paste that and it'll work. Webkit based browsers should show the ᴙ in the URl bar - others might show Punycode.
NB: This is not the Cyrillic ya - it is, instead, a homoglyph.
Touch a Touch a Touch a Touch Me
I think this is the world's first domain name written in Braille.
That uses Unified English Braille - with a Grade Two contraction.
Interestingly, I couldn't get any browser to display Braille in the URl bar. The other domains on this page work - but this one just gave the Punycode representation xn--9iii1c8a.ga
These domains go up to 11
Without a doubt, the loudest band in rock and/or roll are the legendary "Spın̈al Tap" - note the dotless I and the heavy-metal umlaut over the N.
Again, Punycode supports that!
Interestingly, this was the only domain that Firefox displayed without converting to Punycode.
Some kind of Einstein
This one combines another trick. As I pointed out in my post about buying a single character domain name, we can abuse Unicode normalisation in our domain names. So the Unicode Superscript block gets automatically converted to regular text.
This means we can have a domain of:
The "equals" is really "modifier letter short equals sign (U+A78A)" which, surprisingly, doesn't undergo normalisation.
What didn't work
It's always good to share the experiments which didn't produce anything useful. Negative results are results too!
- Zalgo Text doesn't work.
- 🂡 and other playing cards don't work.
- I figured trying to use something like
xn--hsbccom-oy9d61a
would probably get me banned from the Internet pretty quickly! - This didn't open up a portal to the Dark Dimension from which all madness stems. Oh well.
Up next?
If you manage to generate any weird and wonderful domain names, please leave a comment.
Ryan Castellucci :nonbinary_flag: said on infosec.exchange:
@Edent Unicode normalization of URLs is something I'm going to have to add to my bag of tricks now.
Spooky witch 🧙♀️ Sarah said on hachyderm.io:
@Edent Something tells me that email validators won't like the domain in this form 😅(I encounter issue with 'sarah+sth@my.domain' quite often.)
Stubbs said on mastodon.me.uk:
@Edent Chrome warned me that this was a fake site before letting me through 😄
Jon Ribbens says:
The reason browsers aren't displaying these domains the way you want is because they're all invalid and the .ga registry should not have allowed you to register them.
https://tinyurl.com/ynk68tpt https://www.icann.org/en/system/files/files/idn-guidelines-22sep22-en.pdf
@edent says:
I broke the Internet 😢
Joker_vD says:
Apparently, there is an actual IANA registry of what Unicode codepoints that are allowed and disallowed in domain names:
https://www.iana.org/assignments/idna-tables-12.0.0/idna-tables-12.0.0.xhtml
A shame, really, I personally would love to have a "🃏"-containing domain name. Oh well.
tex -Tweeto, ergo sum- said on twitter.com:
Were you able to register these? I thought the registry was supposed to screen out characters like superscripts and the equal sign. The superscript should have been normalized to a plain 2.
@edent says:
Yes, these are all registered. You can click on them and visit the sites.
The superscript is normalised - so it won't ever show in the URl bar. But it can be written as part of the domain.
More comments on Mastodon.