This is a real concern, but browsers and registrars do have some protection against it. IE will render punycode except for scripts in the user's list of accept

This is a real concern, but browsers and registrars do have some protection against it. IE will render punycode except for scripts in the user's list of accepted languages. Many registrars enforce a no-homograph policy and Mozilla browsers will allow IDNs only from those registrars: http://www.mozilla.org/projects/security/tld-idn-policy-list.html http://www.mozilla.org/projects/security/tld-idn-policy-list...