Lookalike Domains: How to Check Before You Sign

A phishing domain is a copy of an address you already trust, built to be clicked exactly once. It does not need to hold your attention for a week. It needs thirty seconds, on a day when you are tired, on a phone, already certain you know where you are going.

Most people check for the padlock and stop. A padlock on a phishing domain proves the connection is encrypted and nothing else. Certificates are free, automated and issued in seconds, so the icon confirms the privacy of transport, not the ownership of the name behind it.

• Lookalike addresses work because they get clicked, not because they are convincing. One visit is enough.
• A padlock shows encryption only. It says nothing about who registered the domain.
• Paid search results are advertising slots. The top result is a purchase, not a verification.
• The signing prompt is where funds leave. Read the domain inside the wallet popup, not the tab behind it.

What a Phishing Domain Actually Copies

A phishing domain copies the parts of an address that people skip: the middle, the suffix, the exact spelling. Imitations rarely look wrong at a glance, because a glance is not the condition they were built to survive.

The page itself is the easy half. Logos, layouts, chat widgets and support scripts are all copied assets, and copying them costs nothing. The part that has to be engineered is the name, and there are only a handful of ways to build one that reads correctly at speed.

Typosquats and character swaps

A typosquat is the same name with one letter moved, doubled or dropped. Doubled consonants and swapped vowels are the most common shapes, because a reader scanning quickly supplies the word they expect rather than the letters that are actually there.

The mechanism is predictive reading. You recognise a familiar string by its outline, not by parsing each character, so a single substitution inside a known word costs you nothing until you are already on the page and past the point of checking.

Homoglyphs: rn against m, l against I

Homoglyphs use characters that render almost identically. The classic pair is rn standing in for m; another is a capital I standing in for a lowercase l.

On a phone, at small type, the difference can be one pixel of spacing. Zooming the address bar is not paranoia. It is the only way to see what the browser actually resolved, rather than what your reading habit substituted.

Extra hyphens and subdomain padding

Extra hyphens split a familiar brand into pieces that still parse. Subdomain padding goes further: a long readable string that ends with the real name, where the genuinely registered domain sits far to the right.

Read domain names from right to left. The label immediately before the suffix is the one that decides who controls the site. Everything to the left of it is decoration the registrant chose and can change at will.

Paid search ads pointed at clones

Search advertising is a delivery channel, not a reputation system. Anyone can buy the top slot for a brand term, and the address displayed in an ad is frequently shortened or formatted differently from the landing page.

A sponsored result sitting above the real one is a purchase, not a confirmation. The same logic applies to links in direct messages, video descriptions, comment threads under an official post, and emails that arrive with a plausible sender name.

Reading the Address Bar on a Lookalike Domain

The address bar is the only part of the page an imitator cannot rewrite. Design, copy and interface elements are all borrowed; the URL is what your browser negotiated with, and it is generated by the network rather than chosen by the page.

Redirects between the click and the page

A redirect is where the visible destination and the actual one come apart. Check the bar after every click, including the second and third of the same session, because a link that begins somewhere familiar can finish elsewhere without any warning.

Expanding the bar on mobile

On mobile the bar truncates by default. Tap it once to expand before reading, and treat any address that shortens the real name to something unrecognisable as a stop rather than a detail.

The Signing Prompt Is the Real Danger Point

The page can lie. The signing prompt cannot, because your wallet reads the request directly from the network rather than from the interface in front of you. That separation is the entire reason the prompt exists.

This is why a convincing clone is only half an attack. It exists to deliver you to a prompt you would otherwise question, and the prompt is where a permission, an approval or a transfer is actually granted. The domain gets you there; the prompt does the work.

Read the domain shown inside the wallet popup, not the one in the browser tab behind it. Check the recipient or contract, the amount, and whether the request is a one-off transfer or an approval that can be reused later without asking again.

Hardware wallets display the destination on their own screen for precisely this reason. That screen sits outside the reach of a compromised browser or a malicious extension, which is why the device confirmation carries more weight than the page you approved from.

The address bar tells you where you are standing. The signing prompt tells you what you are about to give away. Only one of those two things can be undone.

Bookmarking Beats Searching Every Time

A bookmark removes the step where the mistake happens. Searching asks you to identify the correct result under time pressure, with an interface designed to make the paid option look authoritative. A bookmark asks you to click a name you saved when you were calm.

Save the venue once, from an address you verified somewhere other than a search engine, and reach it from the bookmark bar rather than a search field. Do the same for the block explorer, the bridge and the support portal you actually use.

Keep the list short enough that an unfamiliar entry stands out. A folder with forty bookmarks is a search engine with worse ranking.

1. Stop before clicking and reach the site from your own bookmark instead of the link you were sent.
2. Expand the address bar fully and read the name right to left, one label at a time.
3. Compare it character by character against the saved address, watching for rn, capital I, doubled letters and extra hyphens.
4. Ignore the padlock, the design quality and the search ranking. None of them attest to ownership.
5. Log in only if the address matched exactly, then ask whether the site is requesting anything a login does not require.
6. Open the signing request and read the domain, contract and amount inside the wallet popup.
7. Decline anything you did not initiate, and confirm on the hardware screen where the destination is displayed independently.
8. If you skipped a step, treat the session as untrusted, close the tab and start again from the bookmark.