ThinkCritical.eu · Manipulation atlas
Scams and data theftLookalike link
A link or domain only resembles the real one (a hyphen, a different ending, an extra word). What counts is the part just before the first slash.
Fake addresses copy well-known names and add a hyphen, an extra word or a different ending. In parcel-eu.delivery-info.top/pay, the real domain is delivery-info.top – anyone can make up the “parcel-eu” at the start.
The company Trakolog uses the domain trakolog.eu. A scam email “from the CEO” arrives from m.walsh@trakolog-eu.com – a hyphen and a different ending were all it took.
How to spot it
- A hyphen or an extra word: “trakolog-eu”, “account-verify”, “delivery-online”.
- An unusual ending (.top, .info, .net, .com) for a company that normally uses a different one.
- Lookalike characters: “rn” instead of “m”, a zero instead of an “o”.
- The link came in an unexpected text or email and goes straight to a payment or login page.
How to check and what to do
- Don’t click. Type the address yourself, or use the app or a saved bookmark.
- In a link, what counts is the part just before the first slash; in an email address, the part after the @. It must match the official domain exactly.
- On a computer, hover over the link (without clicking) to see where it really leads.
- You’ll find the correct address in your order confirmation, your contract or on a website you know.
Tip: A padlock and “https” in the address bar only mean the connection is encrypted – not that the site is honest.
Full explanation and exercises:
thinkcritical.eu/en/manipulation-atlas/lookalike-link