Lookalike domains, decoded.
Citations that point to fake lookalike websites are flagged.
URLs found
1
Extracted from the passage
Homographs
1
Mixed script or skeleton spoof
Punycode labels
1
ACE xn-- on the wire
Watched-brand hits
1
Folds onto a trusted host
Mixed-script labels
1
Latin plus Cyrillic or Greek in one DNS label. Chrome and Edge show punycode for this.
Skeleton vs register
1
Fold confusables, then compare to WHO, PubMed, Cochrane, SANC, doi.org and known brands.
Punycode / ACE
1
xn-- encoding hides non-ASCII. Decode the label, then fold. The 2017 apple.com demo used this.
Hidden marks in the host
0
Zero-width space inside doi.org still looks like a DOI. Strip, then parse.
Paste a passage with links
Works on https URLs and www hosts. Lookalikes that render as who.int or pubmed still fold onto the watched register.
www.whο.int
Homograph- Unicode host
- www.whο.int
- Punycode (ACE)
- www.xn--wh-kbc.int
- Skeleton
- www.who.int
- Scripts
- latin + greek
Folds onto who.int, a watched academic or brand host.
- Mixed scripts in one DNS label (latin + greek). Browsers treat this as an IDN homograph.
- Skeleton folds to who.int, but the registered host is not who.int.
Watched hosts
- pubmed.ncbi.nlm.nih.gov
- ncbi.nlm.nih.gov
- nih.gov
- doi.org
- who.int
- cdc.gov
- cochrane.org
- nice.org.uk
- gov.za
- westerncape.gov.za
- sanc.co.za
- scholar.google.com
- google.com
- wikipedia.org
- sciencedirect.com
- springer.com
- wiley.com
- jstor.org
- moodle.org
- paypal.com
- apple.com
- microsoft.com
- github.com
- nlm.nih.gov