google.com vs. googIe.com: One is Google. One is not. Can You Tell Which One?
Updated: Oct 7
One thing hackers rely on is the speed at which we expect to get information. Waiting 1 to 2 seconds is fine. Waiting 5 seconds feels like a lifetime. On today’s internet, especially with TikTok, Instagram, and infinite scrolling, people expect information right now. Hackers know this, and they use that "urgency" to trick you.
For educational and illustrative purposes only, here are links to three well-known websites. One link for each website points to the official website of a well known brand, while the other does not.
Can you tell which one is the well-known brand's website? It’s hard to tell, maybe even impossible at a glance.
The Brand Websites
All of the "A" links in the previous image point to the well-known brand websites. The "B" links do not. In this next image, we are highlighting the differences in red.
If you compare the first image to the second image, you will notice how for both Google and Apple, we used a capital "i" so it looks just like a lowercase "L". In this second image we changed the capital "i" back to a lowercase "i", so you can see it it better.
For PayPal, we used a lookalike character for the letter “a” from a different character set. If you look closely, the "ɑ" highlighted in red looks slightly different from the last "a" in PayPal.
Why Is This Important
Artificial Intelligence (AI) has made hacking simpler than ever. Instead of spending hours trying to craft believable fake emails, attackers can use AI to generate them in seconds.
For example, we asked AI to create a fake purchase email that would link to an imposter website. This took AI less than a second to create:
Subject: Your Apple Store Purchase (#AAPL-982401) From: Apple Support <support@apple.com> To: <target-email> Thank you for your order. We are processing your recent purchase. Your item is being prepared for shipment and will dispatch within 24 hours. Order Summary Item: 14-inch MacBook Pro (M-Series, 512GB) Order Number: AAPL-982401 Payment Method: Saved Credit Card Total Billed: $1,586.00 Did you not make this purchase? If you did not place this order or believe your account has been compromised, you must cancel the transaction immediately to prevent authorization: Cancel Your Order & Secure Account (This link would point to an imposter website. In this example technique, an attacker could mask the domain name by using a capital 'i' to mimic a lowercase 'L', making a fake web address look virtually identical to Apple's official website.)
Imagine you get this email. What would your initial reaction be? Would you panic and click "Cancel Your Order & Secure Account" right away because you know you didn't buy a $1,500 laptop?
Even if you hover over the link before clicking, it will look like it's pointing to Apple's website, because the link is using that capital "i" trick.
Scary how easy it is to go to the wrong website, right?
Protecting Yourself from Bad Links
Never click on links in unexpected emails or text messages. This applies even if you think it came from a trusted source, such as a company, colleague, friend, or family member. Remember that their account could have been compromised without their knowledge. So its better to reach out to them directly through a separate message or phone call to confirm it’s legitimate.
Don't click blindly on search ads or results. Especially when looking to download or install software from the web. Hackers are using Google Ads to get you to install malicious software.
Use browser bookmarks. For websites you use daily (like your online bank), save them directly to your browser's Bookmarks or Favorites bar. That way, you never have to rely on clicking links in emails or search engine results.
Stop, pause, and retype. [Highly Recommended Habit] If you need to go to a website's URL, a safe habit to adopt is to:
Copy and paste the entire link into your browser address bar.
Then, highlight just the main website name (the domain name), and delete it.
Finally, manually type it in yourself.
What is a domain name? That’s the main website address that comes right after www.
The domain name for www.google.com is google.com.
The domain name for www.apple.com is apple.com.
The domain name for www.paypal.com is paypal.com.
So, if you get a link to check out the new iPhone that looks like https://www.apple.com/iphone, copy and paste it into your browser, delete the apple.com part, and retype apple.com by hand.
By doing this, you guarantee you are going to the official Apple website.
It takes only 2 seconds to do this, but it can save you hours, if not days or months, of stress, and headaches.
So remember, when dealing with google.com vs. googIe.com: One is Google. One is not. Because you can't tell which one is which, stop, pause and retype.
Important Note Regarding URL Examples: The domain names, web addresses, and URL samples referenced in this article (such as variations of well-known brand names) are provided strictly for educational, informational, and illustrative purposes only. This article demonstrates how character impersonation and lookalike characters can be visually confusing on the web. We make no claim, representation, or accusation that any specific registered, non-brand, or alternative domain name, or its respective owners, is fake, malicious, or engaged in scam activity.