Angvlar Security Awareness
Lookalike domains and deceptive web addresses
Understand how small spelling changes, substituted characters and misleading subdomains imitate trusted websites.
Why this matters
A domain can look familiar while directing you somewhere unrelated. Read addresses from right to left around the registered domain and watch for substitutions such as rn for m, extra words and unusual endings.
By the end of this lesson
- Recognise the main warning signs
- Choose a safe verification method
- Know when and how to report the situation
What to notice
- One character has been replaced or doubled
- The trusted brand appears only in a subdomain
- Extra words such as secure, verify or support
- Unexpected country-code or uncommon domain ending
- Punycode beginning with xn--
- URL shorteners hide the destination
- The page arrived through an unexpected message
What to do
- Read the registered domain carefully
- Use a bookmark or type the known address yourself
- Do not trust a padlock as proof of legitimacy
- Check links on mobile with a long press
- Report lookalike domains to your security contact
- Close the page if anything feels inconsistent
Frequently asked questions
What part of a URL matters most?
The registered domain immediately before the public suffix, such as example.com.
Does HTTPS mean a website is trustworthy?
No. HTTPS encrypts the connection but does not prove who operates the site.
What should I do with a suspected lookalike domain?
Do not interact; capture the address safely and report it.