The single most consequential decision a user makes about any online platform is not which one to use, but whether the site they are on is the one they intended to reach. Look-alike domains are common, they are designed to be mistaken for the real destination, and they are the primary vector for credential theft. This article describes how to tell the difference.

Why Look-Alikes Work

Users frequently arrive at platforms through search results or shared links rather than by typing an address. That behaviour is convenient, but it also means the destination is often chosen by whoever ranked highest or sent the link, not by the user.

Attackers exploit three human tendencies. First, we read words by their shape rather than their letters, so a domain with one character swapped is easy to miss. Second, we trust what appears in a familiar position — the top of search results, the brand-look-alike page, the padlock icon. Third, we click quickly, especially on mobile where the address bar is small.

The Domain Is the Important Part

Page titles, logos, and colours are easy to copy. The domain is not — it is the part of the address that determines which server you are actually talking to.

The domain is the text immediately before the first single forward slash after the scheme. In https://example.com/path, the domain is example.com. Everything after the first slash is a path within that domain and can be anything the domain's owner chooses.

Attackers use subdomains to obscure this. A URL like https://legitname.attacker-domain.com contains the string "legitname" but is on attacker-domain.com. The domain — the part that matters — is the part immediately before the top-level suffix.

Common Deceptions to Watch For

  • Character substitution. A lowercase l for the digit 1, an uppercase I for a lowercase l, a zero for the letter O.
  • Hyphen insertion. A legitimate name with a hyphen added or removed in a plausible place.
  • Different top-level suffix. The same name under a different suffix (.net, .co, .xyz) that is not the one you have previously used.
  • Subdomain camouflage. The brand name appears as a subdomain of an unrelated domain.
  • Look-alike TLD. A TLD that resembles the real one, such as one ending in a visually similar set of characters.
  • Punycode domains. Some characters look identical to Latin letters but are from another script; these are represented in the address bar with a xn-- prefix.

Practical Checks

The following checks reduce the risk of ending up on the wrong site.

Read the domain character by character

Do this every time you are about to enter credentials, even when you believe you already know the address. Familiarity breeds autopilot, and autopilot is what the deception relies on.

Confirm HTTPS

A padlock in the address bar indicates that the connection is encrypted. Its absence is a red flag. Note, however, that HTTPS is a baseline signal, not proof of legitimacy — attackers can and do use HTTPS on their own domains.

Use a bookmark you created yourself

If you have identified the correct destination, save it as a bookmark. From then on, navigate through the bookmark rather than through a search result. This eliminates the entire class of "did I get the right result" problems.

Beware of links in messages

Messages that contain login links are worth treating as suspicious even when they come from someone you know. Accounts are frequently used to send phishing messages to a compromised user's contacts. If the message says something is urgent, that is the moment to slow down.

Compare what you see against what you expect

If a page you reach looks different — different layout, different language, a request for information you have never been asked for before — treat that as a signal, not a coincidence. Close the page and reach the platform through a source you already trust.

When in Doubt

If you are uncertain whether a page is legitimate, the correct response is to stop rather than to investigate. Close the page, reach the platform through a channel you already trust, and compare. If the two look different, the one you arrived at through a link is the one to distrust.

This instinct is worth trusting. Users who override it — because the page looked convincing, or because they had already typed the username — are the ones who end up entering credentials on the wrong site. The cost of pausing is a few seconds. The cost of not pausing can be an account.

If You Suspect You Have Been on the Wrong Site

  1. Change the password immediately from a device you control.
  2. Change the same password on any other account where it was used.
  3. Enable two-step verification if the platform supports it.
  4. Review recent activity on the account for anything unfamiliar.
  5. If a payment method was linked, check recent transactions with the provider.

For the wider picture, the account security guide covers password practices, phishing awareness, and device hygiene in more depth.