The web address shown in your browser bar can look identical to the official one but actually lead to a phishing site. This can really happen. Attackers use "homoglyphs" – characters from different writing systems that look almost the same, such as the Cyrillic "а" and the Latin "a". Your eyes may think they look the same, but browsers and systems tell them apart by their underlying Unicode codes. Spotting this type of attack is not about staring harder; it is about changing the way you verify a link.
Step 1: Look at the rightmost "domain name" – don't be fooled by the prefix
This is the most important step when reading a URL. It has nothing to do with homoglyph characters but helps you instantly rule out most low-effort visual tricks.
What to do: Learn to locate the true "registered domain" instead of looking at the fake parts added in front.
How to do it: In the browser address bar, move your eyes to the far right of the URL and find the first single forward slash "/". The part directly to the left of that "/" is the real registered domain name.
For example, a phishing link might look like: https://account.booking.comんdetailんrestric-access.www-account-booking.com/en/
Don't fix your attention on the opening account.booking.com. Look at the full domain just before the first "/" on the right: www-account-booking.com. That is the actual website this link points to. Booking.com will never use a domain like that.
Completion check: For any web address where you are about to enter sensitive information, you can accurately pull out the "registered domain" from the address bar and not be tricked by the disguise in front.
Step 2: Reproduce it manually to remove visual distractions
If the domain name makes you think "this is definitely the official domain", you might be facing a homoglyph attack.
What to do: Copy the suspicious domain and paste it somewhere else to see its true form as plain text.
How to do it: Select the full domain in the address bar, copy it (Ctrl+C / Cmd+C), and paste it into a notepad, a search box, or a chat window. Check whether the pasted content matches what you expected. Characters like "ん" used to imitate "/" or "а" used to imitate "a" can be easier to spot in a plain text environment, where tiny encoding differences might stand out more.
Common reason for failure: Many people try to spot the difference by just looking at the address bar with their eyes, thinking they can tell characters apart. Modern browser font rendering deliberately makes text look neat and beautiful, which actually helps the attacker. Leaving the browser address bar display and comparing in plain text is a simple way to break visual deception.
High risk: Attackers can buy an SSL certificate for the phishing site so the lock icon shows up, and they can copy the official page design exactly. HTTPS and page appearance are not trust signals. The only things you can truly trust are the registered domain from Step 1 and the habit of actively verifying the address through official channels.
Step 3: Use the "official source comparison" for final confirmation
If the domain name looks fine but you still have the slightest doubt, or you are just not sure, skip every link you received.
What to do: Do not rely on any link from an email or message. Go in through an official bookmark you have saved, or type the official address into the address bar yourself.
How to do it: Close any pages opened from email or social media links. Open a fresh browser tab and type in manually the official domain you want to visit (for example, www.binance.com). Log in there and then do what you need to do. You can treat this as a firm security rule – for any account login, authorization, or money transfer, always start from a URL you typed yourself.
Completion check: You have bypassed all potentially dangerous links and reached the official platform through a trusted entry point.
Extra verification method: If you really feel unsure about a link but have to open and check it (for example, a work email), you can use a "URL decoder" or a "Punycode converter" tool to see the real encoding of the domain. If it begins with xn--, it contains non-Latin characters – a typical sign of a homoglyph attack.
