Guide · Link risk · October 2026 · by Stefan Tsezarov

The domain that looks right

A look-alike address does not have to survive a careful inspection. It only has to look familiar for a moment.

A message says there is a problem with your exchange account. You check the logo, glance at the link and recognise the name.

That moment of recognition is what a look-alike domain relies on.

The address does not have to survive a careful inspection. It only has to look familiar long enough for you to open it, enter a password or connect your wallet.

Here is how the disguise works—and what to check before trusting it.

01Find the domain that matters

Consider this address:

You can see paypal.com, but you are not visiting PayPal. The registered domain is secure-verify.xyz. Whoever controls that domain can put familiar words in front of it.

Those extra parts are called subdomains. They can make an address look official without creating any connection to the company being named.

For ordinary web addresses, start with the hostname—the part after https:// and before the next /. Read that part from the right.

Do not simply take the last two pieces. Some endings, such as co.uk, contain more than one. Browsers use a maintained Public Suffix List to recognise these boundaries. Public Suffix List explanation.

Finding the registered domain tells you which name you are visiting. It does not prove who operates the site or whether it is trustworthy.

02Familiar letters from another alphabet

Some letters from different writing systems look almost identical.

A Cyrillic а can resemble a Latin a. Cyrillic р can resemble Latin p. Depending on the font, the difference may be difficult to see.

For example:

• paypal.com uses Latin letters.
• раypal.com starts with Cyrillic р and а.

They look similar, but they are different domain names.

This is often called a homograph attack: different characters create a familiar-looking name. Unicode’s security guidance describes both mixed-alphabet look-alikes and names written entirely in one alphabet that resemble another. Unicode Technical Standard #39.

Your browser may display an internationalised domain in an encoded form beginning with xn--. Display behaviour varies, so do not rely on the browser to make every disguise obvious.

And do not assume non-Latin letters mean fraud. Many legitimate websites use them. The concern is impersonation, not the alphabet itself.

03Ordinary characters can fool you too

A deceptive name does not need unusual characters.

At a glance:

• 1 can pass for lowercase l: paypa1
• 0 can pass for o
• rn can resemble m: rnicrosoft
• vv can resemble w

These substitutions exploit the way we recognise familiar words without checking every character.

The examples illustrate spelling tricks. They are not claims that a particular domain is currently malicious.

When an address matters, familiarity is not enough. Compare it with an address you already trust.

04A single typing mistake

Other look-alikes use an extra letter, a missing letter or a swapped pair:

• gooogle instead of google
• coinbsae instead of coinbase

This is commonly called typosquatting. It can catch someone who mistypes an address or someone who overlooks the mistake in a message.

A similar spelling is a reason to investigate, not proof of a scam. Unrelated businesses can have similar names.

For an exchange login or wallet connection, though, a small spelling difference is enough reason to stop and open the service through your usual route.

05The right name in the wrong place

A real brand name can appear inside an address without identifying the website.

Compare:

In the first address, paypal.com is placed among the subdomains. In the second, paypal appears in the path—the part after the hostname.

Neither address belongs to PayPal simply because its name appears there.

A brand in a path can be entirely ordinary: news articles, reviews and support pages mention companies every day. Context matters.

Also remember that the words shown in a message are not necessarily its destination. A link labelled “Open Coinbase” can lead somewhere else.

Check the destination address, not just the link’s label.

06What threat lists can tell you

Security tools can compare domains with lists of reported phishing, scam and malware sites.

A match is a strong reason to stop. No match is not a safety guarantee.

A new phishing domain may not have been reported yet. A legitimate website can also be compromised. Neither problem requires an obvious spelling trick.

Treat a scanner as another source of evidence. It cannot turn an unfamiliar link into a trusted one simply because it finds no warning.

07Habits that reduce the risk

You do not need to identify every possible disguise. A few habits reduce how often you have to make that judgement.

• Open sensitive services independently. For an exchange, payment service or wallet app, use a bookmark created from a verified address or open the official app directly.
• Check the address before entering credentials or connecting a wallet. A copied logo and convincing page design tell you little.
• Pay attention when your password manager behaves differently. Password managers generally match saved logins to website addresses. If yours normally offers a login and suddenly does not, investigate before copying the password manually. Autofill behaviour depends on the product and its settings. 1Password explains domain matching and its limits.
• Do not let urgency choose your next action. If a message threatens account closure or claims your funds are at risk, check through the service itself.
• Read the wallet request too. Checking the domain does not replace checking what a transaction or signature authorises.

When a message asks you to log in, move funds or connect a wallet, your next step is simple: open the service independently and check the claim there.

Addresses in this guide that demonstrate a trick are printed as text, not links. They illustrate spelling tricks and are not claims that any particular domain is currently malicious. This article is for educational purposes only and is not financial advice.

Reading a suspicious message in your browser? The scan-selected-text bookmark checks it without copying and pasting, and the text stays in your browser.