Try a domain
The fake above swaps the second letter for ᴏ (U+1D0F, the small capital letter O, marked in red here), which Arial draws exactly like the letter o. Chrome catches this one. Its address bar shows gᴏogle.com as xn--gogle-m29a.com, because ᴏ is outside the characters Unicode recommends for identifiers, and it also flags names that look like a site on its list of popular ones.
But the address bar only comes into it after the click. In an email or a chat message, a link reads however the sender typed it.
We’ve also found other places where lookalikes are shown as written. They’ve been reported to the companies responsible and fixes are under way, so we’ll describe them once they have shipped.
Shown in its xn-- form
Account security
We stopped a sign-in attempt. Review it at gᴏogle.com/security
Shown as the sender wrote it
Can you approve this before 5? gᴏogle.com/docs/q3-budget
Shown as the sender wrote it
The lookalike data comes from confusable-vision, an open-source project by Paul Wood FRSA that measures how alike two characters look.
It casts parallel rays through each character’s outline at 36 angles. Each ray records where it enters and leaves ink, the angle it meets the outline at, and how far it travels through ink each time: its ping, which is the stroke’s width along the ray. When two characters give the same readings at every angle, at the same size and on the same baseline, they are drawn alike. The thresholds were set against 31 pairs whose answer is known, from Unicode’s own confusables list; there has been no study with readers yet. How the method was tested
Below, your browser draws the letter o and the small capital ᴏ and compares them one angle at a time.
This demonstration uses 25 rays at one angle at a time and shows the crossings and pings. The published measurements use 50 rays at each of 36 angles, in 322 fonts (every font on macOS, plus Roboto, Noto and DejaVu), and test shape and size separately.
Whether a swap shows depends on the font. The small capital letter ᴏ (U+1D0F, marked in red) and the ordinary letter o (U+006F) are identical in Arial; in Georgia they are not. When a font doesn’t include a character, the browser draws it with another font, and that substitute can be just as convincing. Each card is graded from what your browser actually draws.
The grade is the share of ink the two glyphs have in common when drawn at the same size on the same baseline. Where the font includes ᴏ, the card also gives the published measurement for that font. 883 of the 2,300 pairs d0ma1n scores are alike only when one character is drawn in a substitute font, as here.
Each registry decides which characters it accepts in a domain name, so a lookalike that .com would sell may be refused by .de. d0ma1n checks every result against the rules of its own TLD. These are the verdicts for gᴏogle at twelve of them.
ᴏ is a Latin letter, so gᴏogle is written in a single script. Most registries refuse labels that mix scripts, such as google with a Cyrillic о, and d0ma1n follows each one’s rule. Some allow a mix: .jp accepts names that combine kanji, hiragana, katakana and Latin letters. It refuses gᴏogle because ᴏ is not in its table of accepted characters.
A scan lists registered lookalikes first, starting with any set up to receive email, since replies to a phishing message would reach whoever holds them. Next come the ones still available to register, then the ones no registry would accept. Each result names the swapped character and, where it was measured, the font in which it is hardest to spot.
Open tools such as dnstwist can already list lookalikes of any domain. What d0ma1n adds is which of them a reader would fall for, which a registry would sell, and who holds the ones already taken.
Loading a live scan…
d0ma1n and its data are open source, built by Paul Wood FRSA (@paultendo). confusable-vision measures which characters look alike, namespace-guard packages those measurements as a library, and d0ma1n adds registry rules and DNS checks.
The same measurements are used beyond d0ma1n. addons.mozilla.org checks add-on names for lookalikes with them, and Mozilla’s source credits them by name. disarm and SilverSpeak use them too.