The Lookalike Domain — Python Bug Hunt

Inspired by IDN homograph attacks: register pаypal.com — with a Cyrillic а — and to human eyes it's indistinguishable from the real thing.

Language: Python
Layer: Backend
Difficulty: Hard
Concepts: Security, Unicode
Modelled on: IDN homographs
Visible tests: the cyrillic clone is flagged; the real domain is not a spoof of itself; genuinely different domains are fine
Reward: 50 XP for a complete fix

Briefing

Inspired by IDN homograph attacks: register pаypal.com — with a Cyrillic а — and to human eyes it's indistinguishable from the real thing. Detection maps confusable characters to a "skeleton" and compares those.

The confusables table is locked. spoofcheck.py isn't using it.

Bug report

BUG-HOMOGLYPH · Priority: High (phishing) · Reported by: trust & safety

is_spoof(candidate, trusted):

True iff skeleton(candidate) == skeleton(trusted) AND candidate != trusted
the trusted domain itself is NOT a spoof of itself

Observed: the Cyrillic clone passes clean, and — worse — the check currently flags the REAL domain as a spoof of itself.

Logs

[registrar] "pаypal.com" (U+0430) cleared for registration
[alerts] "paypal.com" flagged as spoofing "paypal.com" (?!)

The code as shipped

src/sec/spoofcheck.py (editable)

confusables = bug_require("./confusables")

def is_spoof(candidate, trusted):
    return candidate.lower() == trusted.lower()

Read-only context: src/sec/confusables.py.

Open the hunt to edit the files, run the visible tests and submit against the hidden ones. More Python bug hunts.