Typosquatting is not just about misspellings anymore. Attackers now use Cyrillic homoglyphs to make evil domains look identical to trusted brands. Our 230-line detector runs at query time.
From ASCII to confusables
A domain like paypa-l.com is easy to catch with edit distance. But ÐÇð░ÐâÐÇËæl.com, where the Latin a is replaced by Cyrillic ð░, defeats naive string comparison while looking identical to most users.
Normalization first
We normalize Unicode confusables to a canonical ASCII form before scoring. Internationalized domain names are decoded from Punycode, then each character is mapped to its closest ASCII homoglyph if one exists.
Edit distance against the protect-list
After normalization, we compute Damerau-Levenshtein distance against the tenant's protect-list. Domains within a tunable threshold are flagged as typosquats. The whole operation runs inline at ingest time.