Lookalike Domain Checker
Paste a domain to see whether it is written in the characters you think it is. A
Cyrillic а and a Latin a are different characters that look identical, and a
domain built from them is a completely different domain to the one your eye reads.
Nothing leaves your browser — no lookup is performed and no request is made. This reads the characters you typed, nothing more.
How the attack works
Domain names were ASCII for most of the internet’s life. Internationalised domain names changed that so the rest of the world could use its own alphabets — a good and necessary change, with one sharp edge: many alphabets contain characters that are visually identical to Latin ones.
Cyrillic has а, е, о, р, с,
х. Greek has ο, α, ν. On screen they are
indistinguishable from a, e, o, p, c,
x. To a computer they are entirely different, so they make entirely different domains — ones
an attacker can register while your eye reads the real thing.
The domain is not stored as you see it. Non-ASCII names are converted to an ASCII form
beginning xn-- before they are resolved. That Punycode form is the real identity of the
domain, and it is the one shown below — two names that look identical on screen always have different
Punycode.
What the result tells you
Mixed scripts in one label
The strongest signal. A single label written partly in Latin and partly in Cyrillic has essentially no legitimate use — no language is written that way. It is close to a definitive sign of deliberate imitation.
Whole-script imitation
Harder. A name written entirely in Cyrillic is perfectly ordinary for a Russian or Bulgarian site, but
it can also be an imitation of a Latin name using only Cyrillic characters. The famous
аррӏе.com demonstration was exactly this, and because it is not mixed-script it defeated the
protections browsers had at the time. Judge it on context: a Cyrillic name for a Russian bank is
expected, a Cyrillic name for an American technology company is not.
Invisible characters
Zero-width joiners, zero-width spaces and soft hyphens occupy no visual space at all. A name carrying them looks exactly like the name without them and resolves somewhere else entirely.
Bidirectional controls
Right-to-left override characters reverse the display order of everything after them. They are the
mechanism behind the classic filename trick where exe.doc is displayed while
cod.exe executes.
What this can’t tell you
- Whether the domain is actually malicious. It reports what the characters are. A plain ASCII domain can be a phishing site, and a Cyrillic domain is very often entirely legitimate.
- Whether it is registered. No lookup is made. Use the WHOIS lookup for that.
- Every possible confusable. Unicode’s confusables table runs to thousands of entries. This uses a curated set of the characters actually abused in domain names, so an exotic substitution may be reported as merely non-ASCII rather than as a lookalike.
- How your browser will display it. Browsers apply their own rules — many show Punycode rather than the pretty form when a name mixes scripts or uses a script that does not match your locale. Those rules differ between browsers and change over time.
Protecting yourself
| Situation | What to do |
|---|---|
| A link in an email or message | Never judge by how it reads. Copy it here, or navigate to the site the way you normally would instead of clicking. |
| The address bar looks right | Click into it. Most browsers reveal the Punycode form when you focus or copy the URL. |
| You own a brand | Lookalike registrations are worth monitoring. Certificate transparency logs surface them early, often before any site exists. |
| A password manager does not offer to fill | Take it seriously. It matches on the real domain and is immune to how the name looks. |
Once you know what the domain really is, find out who owns it.
WHOIS Lookup SSL Checker Scam TestFrequently asked questions
Are internationalised domains a bad idea?
No. Most of the world does not write in Latin script, and expecting it to is not reasonable. The problem is not that the names exist, it is that some characters are indistinguishable and registrars have historically not prevented the mixing.
Why do browsers sometimes show xn-- instead of the name?
That is the protection working. When a name mixes scripts, or uses a script unrelated to your configured languages, browsers fall back to displaying the Punycode form so the deception cannot work.
Can a password manager be fooled?
No, and this is the most useful practical defence available. A password manager matches the actual domain, not its appearance, so a lookalike simply does not match and it will not offer to fill. If it stays silent on a site you have used before, stop.
Is a mixed-script domain always an attack?
Almost always in practice. No natural language mixes Latin and Cyrillic inside a single word, so there is very little legitimate reason to register such a name.