Spotting Fake and Look-Alike URLs Before You Trust a Page
Most scams start with a web address that is almost right. Learning to read a URL carefully is the cheapest security skill there is, for builders and visitors alike.
A convincing fake rarely breaks in; it gets you to type your details into an address that looks correct at a glance. The defence is reading the URL deliberately. Typosquatting, registering addresses a character or two off a real one, is a whole industry, and it works because almost nobody checks.
Read the real domain, right to left
The part that matters is the registered domain, just left of the first single slash. In login.example.com.secure-pay.io, the actual domain is secure-pay.io, not example.com. Scammers stuff a trusted name into the subdomain or the path, where it looks reassuring but means nothing.
Watch the classic tricks
- Swapped or doubled letters:
rnform,paypa1forpaypal. - Extra words glued on with hyphens:
yourbank-verify.com. - A legitimate-looking name as a subdomain of a domain you have never heard of.
- Look-alike characters from other alphabets that render identically.
Cross-check instead of trusting the link
When a page claims to be a brand you know, do not rely on the link that brought you there. Open the address yourself, and cross-check its claims against independent sources and the brand's own stated notices. This method applies in any language: for example, one Traditional Chinese review page compares a gaming brand's withdrawal and bonus terms against the brand's own platform notices, so a reader can confirm whether a site really is the one it claims to be, this review checking a brand against its own notices (搖錢樹娛樂城). The transferable habit is to verify the entity, not just admire the link.
If you build sites, help your visitors
Use one clear, stable domain. Avoid confusing look-alike subdomains, send email from your real domain, and never ask people to log in through a link that lands on an unfamiliar address. Making your genuine site easy to recognise is part of protecting the people who use it.
// checked 2026-11-10