Check a lookalike address without visiting it
Treat near-matching spelling as a different address, even when the logo and page title look familiar.
The distinction that matters
A comparison should be character-for-character after documented normalisation. It should not accept a one-letter change, a substituted alphabet character or a brand word somewhere in a longer hostname. Internationalised names can have an ASCII representation beginning xn--; displaying that representation helps inspection but is not a safety score.
A worked example
The fictional strings pine.example and p1ne.example are different. So are pine.example and pine-example.test. A visual similarity score might call them close, but closeness is exactly what makes such examples unsuitable for automatic approval. Uppercase versus lowercase in an ordinary hostname is a different issue from changing a letter.
Your next steps
- Read the full host slowly, including its ending.
- Compare the normalised value displayed by the tool.
- Do not paste passwords, full account links or personal details.
- Use an independently reached official source when uncertain.
Where this answer stops
This method cannot detect every malicious website, and a matching domain can still contain a compromised page. A hostname lookup is only one narrow evidence check. The original Get Cyber Safe guidance is linked from the general security resources, not an endorsement of Northline's checker.
Sources & reading
Primary references support the factual context below. Explanations, worked examples and calculations are original Northline analysis. Read how we handle evidence.
- Get Cyber Safe — spoofing and source verification
Government of Canada guidance on impersonation and misleading destinations. It does not certify individual websites. Accessed ; source dated .
An editorial review date is not a new policy effective date. Always check the current source for operator-specific conditions.
Suggest a correction