Create account

This registration intentionally accepts internationalized (non-ASCII / IDN) email domains — the same permissive validation that real apps ship when they want to "support international users". That's the door this lab's attack walks through.

Want to feel the attack? Register victim@xn--securebank-tcd.com-style addresses — generate your own on the Punycode tools page with a domain you actually own, then the reset email lands in your real inbox.