Audits target URLs, API endpoints, and Web3 dApp domains for IDN homograph spoofing, Angel/Pink/Inferno drainer scripts, and hidden DOM prompt injections.