For many organizations puny-coded URLs aren’t necessary for business operations. Longer domains containing homographs are commonly exploited. bankofamerica[.]com is an excellent example with DNSTwist. Few network security tools support regular expressions to allow us to build a rule on the characters used in the homographs, but since the browser converts these to punycode, blocking xn--*.* would cover all of them; however many firewall, SASE and proxy vendors don’t support TLD or mid-string wildcards. But in the case of CrowdStrike, we can use its firewall to achieve our desired result.
Despite the documentation and the GUI validation, there is a bug that doesn’t allow * for the TLD. But we can review ICANN’s current list of TLDs to find the longest ones.
https://data.iana.org/TLD/tlds-alpha-by-domain.txt
Unsurprisingly the top two at 24 and 23 characters, are German: xn--vermgensberatung-pwb .travelersinsurance is the longest English word at 18. TLDs of this length feel punishing; I can’t imagine it increasing after the 2026 gTLD round.
We can instead write our firewall rule to account for characters up to this point.
xn--*.??;xn--*.???;xn--*.????;xn--*.?????;xn--*.??????;xn--*.???????;xn--*.????????;xn--*.?????????;xn--*.???????????;xn--*.????????????;xn--*.????????????;xn--*.?????????????;xn--*.??????????????;xn--*.???????????????;xn--*.????????????????;xn--*.?????????????????;xn--*.??????????????????;xn--*.???????????????????;xn--*.???????????????????;
