Browsers & Accounts · HTTPS & Certificates · Lesson 3 of 5

Look-Alike Domains

Catch misspelled, padded and look-alike web addresses before you sign in.

Spot the fake address

In Staying Safe Online, you learned to read a web address before you trust it. Here's how scammers try to fool that check.

The domain is a site's main name plus its ending, like bank.example. Whoever owns the domain controls every page on it.

A look-alike domain is an address made to look like a real one at a quick glance. It can have a valid certificate and a padlock, as you saw earlier.

Common tricks:

• Typosquatting. This means buying a misspelled copy of a real address, hoping people mistype. Examples: bnak.example, or bank.exmaple.
• Letters that look alike. The letters r and n together look like m. So rnybank.example can pass for mybank.example.
• Extra words. bank-secure-login.example sounds official. But it's a completely different domain from bank.example. Anyone can buy it.
• The real name in front. bank.example.account-check.example starts with your bank's name. But it belongs to account-check.example.

How to find the real domain:

1. Find the first single slash (/) after the name. Ignore everything after it.
2. Look just before that slash. Read the last two parts, the name and its ending.
3. That's who owns the page.

Parts in front of the real domain are fine when the domain is right. login.bank.example belongs to bank.example. The owner chose to add login in front.

Look-alike domains often arrive in texts, emails and search ads. They are usually short-lived. Scammers buy them cheaply, use them for a few days, then move on.

Take your time. Scammers count on people reading only the first few letters.

Look-alike letters and the real domain

Some tricks are even harder to see. Web addresses can use letters from many alphabets, so people around the world can type names in their own language. That's a good thing.

But some letters in other alphabets look exactly like ours. For example, the Russian letter а looks the same as the English a. A scammer can swap one in. The address looks perfect, but it's a different domain.

Browsers try to catch this. When an address mixes alphabets in a suspicious way, the browser may show it in a strange coded form that starts with xn--. Chrome may also show a page asking Did you mean the real site. If you see either, stop and check.

You can't always see these tricks with your eyes. So use habits that don't depend on spotting them:

• Use a bookmark or type the address yourself for banks, email and shopping.
• Use the official app when there is one.
• Don't sign in from links in texts or emails. Go to the site your own way instead.
• Watch your password manager. It saves each password for one exact domain. On a look-alike, it won't offer to fill anything in.

That last habit is a quiet alarm. If your password manager usually fills in your bank password, and suddenly it doesn't, the address may be fake. Don't type the password by hand. Close the page and go to the bank from your bookmark.

A look-alike domain only works if you sign in. With these habits, you never have to.