Unicode characters with a decomposition of 2+ ASCII characters and are registerable domains



This vector shows Unicode characters that have a decomposition of 2 or more ASCII characters, which get normalized by the browser. These characters are valid for use as domain names, expanding short strings into longer ones through decomposition.
Created by: 0x999-x
Created on: Wednesday, May 7, 2025 at 10:33:32 PM
Updated on: Sunday, May 11, 2025 at 11:59:55 PM
Vector type: XSS
Vector charset: UTF-8
Template used:
<a id="x" href="https://$[chr].com">
Code used after fuzz:
function is_domain(domain) {
return domain.split('.').every(part => /^[a-z0-9-]+$/i.test(part));
}
let host = x.host.replace('.com', '')
if(host.length > 1 && host.length < 5 && is_domain(host)){
log($[i] + "=>" + host)
}
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...
Sample payloads
<a id="x" href="https:// .com">
Fuzz results

Chrome 136.0.0.0 desktop Windows NT 10.0
Updated
Wed May 07 2025
Found 175 results
Loading...

Safari 18.4 mobile iOS 18.4.1
Updated
Thu May 08 2025
Found 175 results
Loading...

Firefox 138.0 desktop macOS 10.15
Updated
Fri May 09 2025
Found 175 results
Loading...

Safari 18.4 desktop macOS 10.15.7
Updated
Fri May 09 2025
Found 175 results
Loading...