Reading the hover card
Hover over an underlined link to open the card. The card does not give a verdict. Each row shows a fact you can check.
- Received address
- https://аmazon.com/orders
- List match
- amazon.com
- Changed characters
- а → a · Cyrillic U+0430
- Punycode
- xn--mazon-3ve.com
- Registered
- 2005-01-21 · MarkMonitor Inc.
Row by row
Received address
The address the link actually goes to. This is the address attached to the link, not the text you see on screen. Example: https://аmazon.com/orders. For redirect addresses such as Gmail's, the unwrapped destination is shown.
List match
Which listed domain the received address resembles. Example: amazon.com. This row states only the resemblance. It does not say whether the two addresses belong to the same owner.
Changed characters
The characters that were swapped for lookalikes, and their script. Example: а → a · Cyrillic U+0430. It means the Cyrillic а (U+0430) was used where the Latin a would be.
Punycode
The ASCII form the browser uses internally. Example: xn--mazon-3ve.com. When mixed characters are present, the form starts with xn--.
Registered
The domain registration date and registrar from an RDAP lookup. Example: 2005-01-21 · MarkMonitor Inc.. The lookup sends the domain name only, never the path or query. If the lookup returns nothing, the row has no value.
When you click a link
Clicking an underlined link does not open it right away. A confirm dialog opens first.
Check before opening
https://аmazon.com/orders
- Close: closes the dialog without opening anything.
- Open {listed domain}: opens the listed domain instead of the received address. Example:
Open amazon.com. - Address checked → Open: select the checkbox to open the received address as is.
The five cases that get an underline
| Case | Example |
|---|---|
| Lookalike characters | аmazon.com (Cyrillic а) |
| Lookalike spelling | paypa1.com (digit 1 in place of lowercase l) |
| Listed domain inside subdomain | amazon.com.example.xyz |
| Shown and actual address differ | Text reads amazon.com, destination is another domain |
| Mixed scripts | Letters from different scripts mixed within one domain name |