OneTaskBy Tim King · Updated
Homograph Checker
Detect Mixed Cyrillic and Latin Letters and Lookalike Domains Such as paypa1
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Homograph Checker works
This homograph checker looks for domains that are built to look like somebody else's. Paste one domain or link per line and each is checked for mixed scripts, lookalike letters from other alphabets and spellings that imitate a well-known brand.
What the homograph checker looks for
An IDN homograph attack registers a domain with letters from another alphabet that look identical to
Latin ones. The Cyrillic а, р and е are indistinguishable from a, p and e in most fonts, so аррӏе.com
reads as apple.com but is a completely different domain, xn--80ak6aa92e.com.
The checker decodes any xn-- labels, then applies three tests. Mixed scripts flags a label that combines alphabets such as Latin and Cyrillic. Japanese, Chinese and Korean combinations that are normal in those languages are allowed. Whole-script lookalikes flags a label written entirely in another alphabet whose letters all have a Latin twin. Lookalike spelling reduces each label to a skeleton, swapping confusable letters, 0 for o, 1 for l and rn for m, and compares it with about fifty brands that phishers often copy.
Worked example. Pasting paypa1.com gives a lookalike spelling warning, because 1 stands in for l
and the skeleton paypal matches a brand on the list. Pasting аррӏе.com gives a whole-script warning,
since every letter has a Latin twin. Pasting an ordinary domain such as example.com gives no warnings.
A domain that contains a brand inside a longer name, such as paypal-secure-login.net, is also marked. That is not proof of phishing, but the real company rarely uses names like that.
FAQ
Does a clean result mean the site is safe?
No. The checker only looks at how the name is spelled. A domain with ordinary letters can still host a phishing page, and new brands are not on the list. Treat a clean result as one less warning sign, not as approval.
Why are some domains with foreign letters not flagged?
A domain written entirely in Cyrillic, Greek or another script is legitimate when its letters do not all have Latin twins, such as a Russian word under .рф. Only labels that mix scripts or could be read as Latin text are flagged.
How can I protect my own brand from homograph domains?
Register the most obvious lookalikes yourself, monitor certificate transparency logs for new certificates that contain your name, and set up DMARC so lookalike domains cannot send mail as your real domain.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Punycode Converter
Convert domains between Unicode and xn-- Punycode in both directions.
Unicode Confusables Detector
Find lookalike and invisible Unicode characters hiding in text.
URL Validator
Check a list of URLs for syntax errors, one per line.
URL Extractor
Pull every link out of a block of text.
URL Query Parser
Split a URL into a readable table of parameters.