Doppelgänger

Blocks lookalike (homograph) domains as they load, marks links to them before you click, and flags special characters.

A lookalike domain swaps a letter for a character from another alphabet that looks the same. To you, "аpple.com" and "apple.com" are identical. To your browser they are different sites, and the fake one can get its own valid HTTPS padlock. The padlock only tells you the connection is encrypted, not who is on the other end. Doppelgänger checks every address you open as it loads, and every link on a page before you click it. There is nothing to set up and no list to keep. • A lookalike of a real site gets a warning page instead of the site: "This is not apple.com", with the fake characters highlighted and named (for example "а U+0430 · Cyrillic"), and one click to the real site. • An address built to deceive, even one that imitates nothing Doppelgänger knows, is blocked too: words that mix alphabets, or special characters that all pass for plain English letters. • An address that uses special characters with no sign of a disguise, such as a German or Russian domain, loads with a banner across the top naming each character, so you always know. • If you continue to a blocked site anyway, a red banner stays on the page, and nothing can be typed or pasted into it until you confirm in Chrome's own dialog. • If a site you open reads the same as one you've signed in to, Doppelgänger asks which one is yours instead of guessing. • Links are checked before you click them, in webmail and anywhere else: a dangerous link gets a red outline and a label ("Fake apple.com"), even behind Outlook Safe Links or Proofpoint, and a link whose text says paypal.com but goes elsewhere is marked too. Hover for the details. • The toolbar icon stays calm on ordinary pages, turns blue on addresses with special characters, and red on anything blocked. Links in email that pass through link scanners such as Outlook Safe Links are checked where they land, not just where they start. It catches characters from other alphabets (Cyrillic, Greek and more), look-alike digits ("paypa1"), letter pairs that read as one ("rn" for "m"), and added accents. Detection uses the Unicode Consortium's confusables data (UTS #39) and the list of popular domains Chrome itself uses for its lookalike checks, plus the sites you sign in to. It only learns a site from a visit you started by typing its address or opening a bookmark, so a phishing link can never teach it a fake. Everything runs on your device. Doppelgänger makes no network requests, has no account and no server, and never reads what you type into password fields. What it does not catch: misspellings (amazom.com), or real names buried in other domains (apple.com-login.example).