Free tool
Lookalike domain checker. Is this really the site it pretends to be?
Paste a link or type a domain to check it for the tricks phishing uses to imitate a real address: look-alike letters from other alphabets, punycode, typosquats of well-known brands, misleading subdomains and risky domain endings.
The check runs in your browser. The link is not opened, fetched or sent anywhere.
What it checks
A domain can look right and still be wrong.
Phishing links rarely use the real domain of the brand they imitate. They use one that looks close enough at a glance: paypa1.com with a digit one, a Cyrillic “а” in place of a Latin “a”, or the real name placed in front of someone else’s domain, as in paypal.com.account-verify.xyz.
This tool reads the address the way a browser does, finds the part that decides who owns the site, and compares it with the domains of brands that are often impersonated, using the same rules as the AntiBait analyzer.
Homographs and punycode
Letters from Cyrillic, Greek and other alphabets that pass for Latin ones, and xn-- domains decoded to show what the address bar displays.
Brand typosquats
Domains one or two letters away from a well-known brand, digits in place of letters (0 for o, 1 for l), and the brand name joined with other words or on another ending.
Misleading structure
A brand name used as a subdomain of someone else’s domain, text before an @ that browsers ignore, and IP addresses written to hide what they are.
Risky endings and hosts
Domain endings that show up often in abuse reports, endings that look like file names (.zip, .mov), link shorteners and free hosting services.
Reading the result
How to read the result.
The registered domain is the part that matters: whoever registered it controls every address that ends with it.
- Opens
- The host the browser would actually connect to, after removing anything that is only there to mislead.
- Shown as
- How the address may appear on screen when it contains international letters. If it differs from what you expected, read it letter by letter.
- Registered domain
- The name someone bought, such as example.com or example.co.uk. Everything to the left of it can be chosen freely by its owner.
- High risk
- A trick that has no ordinary explanation, such as mixed alphabets or a brand’s exact name in front of another domain. Do not enter any details on such a site.
- Warning and Note
- Patterns that phishing uses, but that legitimate sites have too. Weigh them together with where the link came from.
Questions
Common questions.
What is a homograph attack?
Registering a domain whose letters come from another alphabet but look identical, for example a Cyrillic “а” instead of the Latin “a”. Browsers show many such names in their readable form, so the address looks genuine. Behind the scenes it is a different domain, written in punycode as xn--….
What is typosquatting?
Registering a domain that differs from a popular one by a typing mistake: a missing, doubled or swapped letter, or a digit in place of a similar letter. Attackers use them in phishing links and to catch people who mistype an address.
Does no finding mean the site is safe?
No. The tool checks the name only. A brand-new domain with an unremarkable name can host a phishing page, and a genuine domain can host a malicious file uploaded by someone else. Look at where the link came from and what the page asks you to do.
Which brands does it know?
Several dozen services that are often impersonated: banks, payment providers, couriers, marketplaces and large online platforms, with a focus on those used in Poland, plus global ones such as Microsoft, Google, Apple and PayPal. A domain that imitates a brand outside the list may not be flagged as a lookalike, but the other checks still apply.
Is it safe to paste a suspicious link here?
Yes. The link is analysed as text in your browser. It is not opened, and nothing about it is sent to AntiBait or any other service.
Full analysis
Not sure about the whole email? Check all of it.
This tool looks at one part of a message. The AntiBait analyzer reads the whole email: sender authentication, links and where they redirect, attachments, the text itself and the sender’s identity, and explains its verdict. You can try it for free, without creating an account.