Look-alike domain checker (homograph & punycode)
Check a link or domain for look-alike tricks: letters from other alphabets, digits for letters, a hidden real domain. Shows the real punycode (xn--) address.
Runs on your deviceRuns entirely in your browser: nothing you type or upload leaves your device.
An automated check; it doesn't guarantee security.
How to use it
- Paste the suspicious link or domain. The check runs in your browser; nothing is sent.
- Press Check to see the real punycode address and every non-English character with its code point.
- If the verdict is red, don't open the link or enter any data on that site.
Five tricks the checker looks for
A link can look right at a glance and still lead somewhere else. The checker catches five common tricks: letters from another alphabet that look Latin (a Cyrillic а instead of a), digits in place of letters (0 for o, 1 for l), letter pairs that read as another letter (rn as m, vv as w), non-English characters that can imitate a known name, and a real-looking start that hides the real domain, as in tubanco.co.verificar-cuenta.info, where the site you land on is verificar-cuenta.info.
Use it before typing a password on a page you reached from a message, or when a customer forwards you a link that uses your shop's name and you want to see exactly what's different.
How one Cyrillic letter shows up
Paste https://tubаnco.co/login, where the а is Cyrillic. The verdict is red: “High risk: this name mixes or imitates letters from another alphabet. A legitimate site in that language can look like this too.” Below it comes the real address your browser connects to, xn--tubnco-5nf.co, then How it can be displayed, tubаnco.co, and Looks like, tubanco.co. A note says the name mixes alphabets (Latin + Cyrillic), and the table lists the character а, code U+0430 CYRILLIC SMALL LETTER A, script Cyrillic, can pass for a.
The xn-- address is the one that counts: it's a different domain from tubanco.co, registered by someone else. Amber results are milder: tubanc0.co with a zero gets a warning about digits, and a Spanish name with ñ or accents gets a note that non-English characters are normal in some languages but worth a look.
What a green result doesn't cover
The checker only looks at the characters and the shape of the name. Plain-letter imitations such as tubanco-seguro.com or tubancoenlinea.co pass green, because nothing in them is hidden. It doesn't know which domains belong to which company: compare with the address you normally type, or use the scam checker, which knows the official domains of about 120 banks, stores and government offices.
Browsers often show the xn-- form in the address bar when a name mixes alphabets, but a text message or an email shows whatever the sender typed. That's why the check matters most before you tap, not after.
FAQ
What is a homograph attack?
A trick where a phishing domain uses letters from another alphabet that look identical to Latin ones, like a Cyrillic `а` in `tubаnco.co`. To your eye it's the real site; to your browser it's a different domain.
What is punycode (xn--)?
The ASCII form browsers use for domains with non-English characters. `еxample.com` written with a Cyrillic `е` becomes `xn--xample-2of.com`, which makes the trick obvious.
If the result is green, is the site safe?
No. It only means no look-alike characters were found. Scammers also register ordinary names that imitate brands, like `tubanco-login-seguro.com`, so always check that the domain is exactly the one you expect.
Can I check the sender of an email?
Yes. Paste the part after the @, for example `soporte.tubanco.co` from `alertas@soporte.tubanco.co`. Keep in mind that the sender shown in an email can be forged completely; the email security checker tells you whether a domain protects itself against that.
Is punycode (xn--) always a bad sign?
No. It's simply how domain names with non-English characters are stored, and many legitimate sites in Spanish, German, Chinese or Arabic use it. What matters is whether the name imitates another domain, which is what the verdict tells you.
Guides for this tool
- G1Is this link safe? How to check a link before you clickFind the real domain in a link, expand short links, spot look-alike letters and brand-new domains, and know what to do if you already clicked.
- G4How to spot a fake website and check if a store is legitCheck the address, the domain's age and the page itself to tell whether a website or online store is real, and what to do if you already paid.
- G9Fake rental listings: how to spot one before you payCopied photos, an owner who is abroad, a deposit before any visit: how to check a rental listing and its booking page, and what to do if you already paid.
- G19Package held text scam: how to check a delivery messageA text says your parcel is held and asks for a small fee or your address? How to check it with the courier, read the link, and what to do if you paid.
- G21Fake DIAN emails: how to spot them and check what you oweA message says you owe DIAN, face an embargo or your RUT will be suspended? How to check it, see your real tax status, and what to do if you clicked.
- G23Nequi or Daviplata account stolen? What to do nowHow Nequi and Daviplata accounts get stolen with fake support, code requests and SIM swaps, how to block yours fast, and the one rule that prevents it.
More in this chapter
- 1.1Is it a scam?Paste a message or link you received and see its warning signs: brand look-alikes, new domains, short links, scam wording.
- 1.2Scammed or hacked? What nowSteps for the first hours after a scam or a hack: a bad link, a shared code, a stolen WhatsApp, money sent.
- 1.3Is this file safe?See what a file from WhatsApp or email really is and spot attachment tricks: disguised programs, macros, PDF scripts, SMS-reading apps.
- 1.4Short link expanderSee where a short link (bit.ly, t.co, tinyurl…) really goes before you click it: every redirect, the final URL and warning signs.
- 1.5Website security scanPassive check of a website's homepage: HTTPS redirect, TLS certificate, HSTS, CSP, clickjacking, cookie flags and security.txt, with a grade and fixes.
- 1.6SSL certificate checkerCheck any site's SSL/TLS certificate: whether it's valid, when it expires, who issued it, which names it covers and the TLS version in use.
- 1.8Domain age checkerSee when a domain was registered, when it expires, its registrar and nameservers.
- 1.9Password generatorRandom passwords (8 to 128 characters) or passphrases, made in your browser with its cryptographic generator.
- 1.10Certificate decoderPaste a PEM certificate to read its subject, issuer, validity dates, SANs, key type and size, and its SHA-256 and SHA-1 fingerprints.
- 1.11Leaked password checkCheck if a password appears in known data breaches without sending it: with k-anonymity only 5 characters of its hash leave your device.
- 1.12Link cleanerStrip utm_, fbclid, gclid, si and other tracking parameters from links before you share them.
- 1.13Watermark an ID copyStamp who a copy of your ID is for, and the date, across the whole photo or PDF, then download a smaller copy with no photo data.
- 1.14Encrypt textEncrypt and decrypt messages or notes with a password (AES-256-GCM) in your browser.
╌╌ END ╌╌