whatisgithub

What is deceptiveidn?

trailofbits/deceptiveidn — explained in plain English

Analysis updated 2026-07-25 · repo last pushed 2017-05-08

61PythonAudience · ops devopsComplexity · 3/5DormantSetup · moderate

In one sentence

A tool that detects fake website domains by rendering them as images and using optical character recognition to see what the domain looks like to a human eye, flagging mismatches as deceptive.

Mindmap

mindmap
  root((repo))
    What it does
      Detects fake domains
      Renders domains as images
      Uses OCR to read them
      Flags visual mismatches
    Tech stack
      Python
      OCR engine
    Use cases
      Phishing detection
      Brand protection
      Anti-fraud screening
    Audience
      Security teams
      Anti-fraud groups
      Brand protection specialists

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

What do people build with it?

USE CASE 1

Detect phishing domains that mimic well-known brands using lookalike characters from other alphabets.

USE CASE 2

Screen newly registered domains for visual deception before they reach end users.

USE CASE 3

Automate brand-protection workflows by flagging domains that visually imitate a company's web address.

What is it built with?

PythonOCR

How does it compare?

trailofbits/deceptiveidnalbertaworlds/japanese-corpus-syntactic-analysis-agentblue-pen5805/comfyui-krea2-negpip
Stars616161
LanguagePythonPythonPython
Last pushed2017-05-08
MaintenanceDormant
Setup difficultymoderatehardmoderate
Complexity3/54/52/5
Audienceops devopsresearchergeneral

Figures from each repo's GitHub metadata at analysis time.

How do you get it running?

Difficulty · moderate Time to first run · 30min

Requires an OCR engine dependency and likely a rendering backend, plus Python environment setup.

So what is it?

Deceptive IDN is a tool that spots fake website domains designed to trick people into thinking they're visiting a legitimate site. Scammers use internationalized domain names, which allow non-Latin characters like Cyrillic or Greek letters, to create lookalike addresses where a character that appears to be a Latin "e" or "a" is actually a different letter from another alphabet. To the human eye, the domain looks correct, but it's pointing somewhere malicious. The tool works by treating each domain name as a visual puzzle rather than just text. It renders the internationalized domain so it looks like an image, then uses optical character recognition (the same technology that extracts text from scanned documents) to "read" what the domain looks like. If the visual reading differs from the actual registered domain, it flags the domain as deceptive and lists what a person's eyes would likely interpret it as. Security teams, anti-fraud groups, and brand-protection specialists would find this most useful. For example, if a phishing campaign registers a domain that visually mimics a well-known brand like "epic.com" using Cyrillic characters, this tool can automatically detect the deception and identify the real domain the scammer is targeting. It helps catch lookalike domains before they reach end users. What's notable is the approach itself: instead of maintaining lists of which international characters look like which Latin characters, it leans on computer vision to simulate how a human would actually see the domain. The README doesn't go into detail on accuracy or limitations, so users would need to test it against their own cases to gauge how reliably it catches less obvious lookalikes.

Copy-paste prompts

Prompt 1
Set up Deceptive IDN to scan a list of newly registered domains and flag any that visually mimic my company's brand domain using non-Latin characters.
Prompt 2
Use Deceptive IDN to check whether the domain 'epic.com' written with Cyrillic characters would be detected as deceptive, and show what a human eye would interpret it as.
Prompt 3
Build an automated pipeline that feeds suspicious domains into Deceptive IDN and outputs a report of flagged deceptive domains with their visual lookalike targets.
Prompt 4
Test Deceptive IDN against a set of known phishing domains using mixed Latin and Cyrillic characters to evaluate how reliably it catches lookalikes.

Frequently asked questions

What is deceptiveidn?

A tool that detects fake website domains by rendering them as images and using optical character recognition to see what the domain looks like to a human eye, flagging mismatches as deceptive.

What language is deceptiveidn written in?

Mainly Python. The stack also includes Python, OCR.

Is deceptiveidn actively maintained?

Dormant — no commits in 2+ years (last push 2017-05-08).

How hard is deceptiveidn to set up?

Setup difficulty is rated moderate, with roughly 30min to a first successful run.

Who is deceptiveidn for?

Mainly ops devops.

Open on GitHub → Ask about another repo

This repo across BitVibe Labs

Verify against the repo before relying on details.