Unicode characters with a decomposition of 2+ ASCII characters and are registerable domains

Chrome logo 175
Safari logo 175
Firefox logo 175

This vector shows Unicode characters that have a decomposition of 2 or more ASCII characters, which get normalized by the browser. These characters are valid for use as domain names, expanding short strings into longer ones through decomposition.

Created by: 0x999-x

Created on: Wednesday, May 7, 2025 at 10:33:32 PM

Updated on: Sunday, May 11, 2025 at 11:59:55 PM

Vector type: XSS

Vector charset: UTF-8

Template used:
<a id="x" href="https://$[chr].com">
Code used after fuzz:
function is_domain(domain) {
  return domain.split('.').every(part => /^[a-z0-9-]+$/i.test(part));
}
let host = x.host.replace('.com', '')
if(host.length > 1 && host.length < 5 && is_domain(host)){
log($[i] + "=>" + host)
}
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...

Sample payloads

<a id="x" href="https://.com">

Fuzz results

Chrome logo
Chrome 136.0.0.0 desktop Windows NT 10.0

Updated

Wed May 07 2025
Found 175 results
Loading...
Safari logo
Safari 18.4 mobile iOS 18.4.1

Updated

Thu May 08 2025
Found 175 results
Loading...
Firefox logo
Firefox 138.0 desktop macOS 10.15

Updated

Fri May 09 2025
Found 175 results
Loading...
Safari logo
Safari 18.4 desktop macOS 10.15.7

Updated

Fri May 09 2025
Found 175 results
Loading...