Lookalike domain examples
A lookalike domain tries to make the destination appear related to a trusted organization while using a different hostname. The safest way to analyze it is to identify the actual hostname and registrable domain, then compare that with the official domain you expected.
- A brand-like word in a subdomain does not control the registrable domain.
- Extra hyphens, labels or characters can make a different hostname look familiar.
- Internationalized domains are legitimate technology but can create visual ambiguity.
- Examples below use reserved example domains and are intentionally non-operational.
Safe synthetic examples
These examples are for explanation only and use reserved example namespaces.
account.example.comA normal subdomain of example.com. The controlling domain is example.com.
example.com.security-check.example.netThe trusted-looking text appears on the left, but the destination belongs to example.net.
example-support-login.exampleA separate domain that uses descriptive words to create familiarity. Words alone do not prove affiliation.
xn--example-... .exampleIllustrative punycode-style notation. Real IDNs can be legitimate; inspect the Unicode name and domain ownership rather than assuming malicious intent.
The rightmost domain labels matter
People tend to scan URLs from left to right, which makes long subdomain strings easy to misread. In a hostname such as account.example.com.security-check.example.net, the destination is under example.net, not example.com.
More detail
Attackers can exploit this reading habit by placing familiar names early in a hostname. A scanner can flag unusually deep subdomains, but users should still learn to identify the actual registrable domain.
Misspellings and inserted words
Lookalikes can add a character, remove a character, replace a character with a visually similar one, or attach words such as secure, support, verify or login. Some legitimate third-party services also use brand-related words, so a textual resemblance is a warning to verify ownership rather than proof of fraud.
More detail
Can I Share This? includes a limited heuristic for recognizable brand names appearing on domains that are not in its recognized-domain list. This is intentionally conservative and should be read as a prompt to inspect the destination.
Internationalized Domain Names and punycode
ICANN's IDN program supports domain names containing characters from many scripts. At the protocol level, some internationalized labels are represented in ASCII using an xn-- prefix.
More detail
That mechanism is not malicious. The security issue is visual similarity: two different Unicode strings can sometimes look confusingly alike. A punycode label therefore deserves careful inspection when the link was unexpected.
Subdomains versus ownership
A subdomain is controlled by whoever controls its parent domain. For example, help.example.com is under example.com. By contrast, example.com.help-center.example.net is under example.net even though example.com appears inside the hostname.
More detail
This distinction is one of the most useful skills for manually checking suspicious links because copied logos, page titles and path names do not change who controls the destination domain.
Safe way to verify a suspected lookalike
Do not test the destination by logging in. Find the official site through a bookmark, official app, trusted search result or known documentation, then compare the hostname character by character.
More detail
If the message asks for sensitive information, contact the organization through an independently obtained channel. A domain that only resembles an official name should not inherit the official site's trust.
Primary references
These references define or document the web and security concepts discussed above.
Related reference pages
Check a suspicious link
Use the scanner to inspect the URL, redirects and final destination before you open it.