Homograph Domain Spoofing Detector (2D)

Lookalike Domain Pair

Detection

Flag threshold — similarity ≥ 70%

Highlight confusable characters

Show punycode (IDN / xn--) encoding

SAFE

Similarity score

Edit distance

Confusable characters

How it works

A homograph (IDN) phishing domain swaps one or more characters for a visually identical or near-identical glyph from another Unicode block — e.g. Cyrillic а (U+0430) for Latin a — or for a digit that looks like a letter (0 for o). Detection compares the candidate against a trusted brand domain with a confusable-aware Levenshtein distance:

cost(a_i, b_j) =
  0   if a_i == b_j                      (exact match)
  0   if skeleton(a_i) == skeleton(b_j)   (visually confusable — free)
  1   otherwise                          (a real difference)
insertion / deletion cost = 1 always

similarity = 1 − distance / max(len(A), len(B))

The skeleton() function is the same idea browsers and registrars use under Unicode Technical Standard #39: it maps every character to a canonical representative of its confusable class, so "pаypal" (with a Cyrillic а) and "paypal" collapse to the same skeleton even though they are different strings byte-for-byte.

Scenario — a real trusted domain (top row) next to a candidate that a user actually received in a link or email (bottom row).
Threshold slider — the similarity a security filter requires before flagging a domain as impersonation; raising it makes the filter stricter (catches more lookalikes) at the cost of more false positives on genuinely unrelated names.
Punycode — browsers can't route on raw Unicode, so any label containing non-ASCII characters is transcoded to ASCII with an xn-- prefix per RFC 3492 before DNS resolution; this is the string that would actually appear in the address bar of a browser that doesn't render the Unicode form.
Connecting lines: green = identical character, amber = confusable substitution (visually free, semantically an attack), red = a genuine insertion/deletion/substitution.
Drag the field to pan, scroll or pinch to zoom in on long combosquatted domains.

Real-world relevance: this is the defensive mechanism behind brand-protection crawlers, browser IDN-spoof warnings, and mail-gateway anti-phishing filters — never a tool for registering or serving lookalike domains.

Trusted: paypal.comCandidate: pаypal.com

Match Confusable Real difference

drag to pan · scroll to zoom