Preliminary research

Turning IDN edge cases into typosquats

Ian Muscat and Leanne Briffa · Have I Been Squatted · 3 October 2026

AI-collected research leads through 3 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

The article models current Chromium IDN display and navigation checks, then uses same-script breaker characters with surviving skeletons to build visually deceptive domains. It tests live registrations, registry feasibility, .com zone pairs and sender rendering in Gmail and Outlook, while reporting the limits of its candidate model.

Record

Researcher

Ian Muscat and Leanne Briffa

Published by

Have I Been Squatted

Date

3 October 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Earlier Chromium-policy bypass analysis
• Earlier systematic assessment
• Glyph-similarity dataset and method

Tags

• homograph
• unicode
• typosquatting
• phishing
• browser
• email
• owasp-a04-2021
• owasp-a06-2021

This page is the archive's own catalogue record. The research is the work of Ian Muscat and Leanne Briffa, first published at the original source. Preserved copies are kept so the citation survives its host.