Free tool
Lookalike characters
The “а” in аpple.com can be a Cyrillic letter: on screen, there is no way to tell. Paste a link, an address or a domain name: we go through it character by character.
Why letters can lie
Since 2010, domain names can be written in any alphabet: café.fr, пример.рф, 例え.jp. That is good news for most of the world, and a gift for fraudsters.
The Cyrillic alphabet has an “а”, an “е”, an “о”, a “р” and a “с” that are pixel-for-pixel identical to ours. Greek, Armenian and Cherokee have their own lookalikes. Behind the scenes, a domain that contains them is stored in a technical form that starts with xn-- (called punycode): аррӏе.com is really xn--80ak6aa92e.com, a completely different domain from apple.com.
Browsers defend themselves by showing the xn-- form when a name looks suspicious, but email software, text messages and documents often do not.
The tricks we look for
аpple.com
Lookalike letters
Letters from another alphabet (Cyrillic, Greek…), full-width or “math” letters that imitate ours.
Our table has well over a hundred of them.
paypa1 · rnicrosoft
Digits and pairs
A 1 for an l, a 0 for an o, “rn” for “m”, “vv” for “w”, “cl” for “d”.
No exotic character at all: only your eyes are fooled.
U+200B · U+202E
Invisible characters
Zero-width spaces, and direction marks that turn “exe.pdf” into “fdp.exe” behind your back.
Shown here as ⟨∅⟩ and ⟨⇄⟩.
desjardins.com@…
Disguises
A real brand domain placed before an @, or as a subdomain: paypal.com.verify-account.net.
The domain that counts is always the last one.
How to read the result
Red means a strong sign of imitation: mixed alphabets in one word, a name that reads exactly like a known brand without being theirs, an invisible character. Yellow asks for a second look. Blue is information: an accented letter or another alphabet used legitimately.
We compare with a short list of brands often imitated in Canada (big banks, Desjardins, Interac, Canada Post, CRA, Revenu Québec, Hydro-Québec, Microsoft, Google, Apple, Amazon, PayPal, Netflix and a few others). A clean result does not mean the site is safe: it only means the name is not disguised. To check whether a site is flagged as dangerous, use our safe browsing check.
What to do with a suspicious link
- Do not click itGo to the company's site by typing its address yourself, or through your usual app or bookmark.
- Do not reply and do not enter anythingNo password, no card number, no code received by text message.
- Report itForward the message to the company being imitated (most have a phishing address), and to the Canadian Anti-Fraud Centre.
Frequently asked questions
How can I tell if a link or address contains lookalike characters?
Paste the link, address or domain name: the tool goes through it character by character. It spots letters from other alphabets, invisible characters, punycode and brand lookalikes, right in your browser.
How do I read the colours in the result?
Red is a strong sign of imitation, such as mixed alphabets in one word or an invisible character. Yellow asks for a second look. Blue is information: an accented letter or another alphabet used legitimately.
Does a clean result mean the site is safe?
No, only that the name is not disguised. The site itself can still be fraudulent. To check whether a site is flagged as dangerous, use the safe browsing check.
What should I do with a suspicious link?
Do not click it: go to the company's site by typing the address yourself. Do not reply or enter anything. Report the message to the company being imitated and to the Canadian Anti-Fraud Centre.
