Can a look-alike domain swap letters that look the same?
Yes.
Last read from the sources at the foot of this page.
Which letters get swapped?
( m → rn ) LATIN SMALL LETTER M → LATIN SMALL LETTER R, LATIN SMALL LETTER N
The Unicode list matches the small letter m to the pair r and n. It matches the digit 1 to the small letter l. It matches the digit 0 to the capital letter O.
So a name like yourfirm.example can become yourfirrn.example, and a name with an l in it can carry a 1 instead. In many fonts the change is hard to see in an email header.
Why do these swaps work?
The data in [ confusables ] provide a mechanism for determining when two strings are visually confusable.
The Unicode Consortium publishes this data as a way to decide when two strings are visually confusable. The edition we read is dated 6 August 2026.
Software can compare the two strings character by character. A busy reader compares them by eye, and the eye reads a word as a shape.
What can I do about letter swaps?
( 1 → l ) DIGIT ONE → LATIN SMALL LETTER L
- List the swaps that fit your own name: m and rn, l and 1, o and 0.
- Check whether those names are registered, and register the closest free ones yourself.
- Read a sender's address letter by letter before you act on a payment request.
- Zoom in on the address if a name looks right but the request is unusual.
Where does this come from?
- Unicode: confusables.txt (UTS #39 data, version 18.0.0)unicode.orgRead 14 October 2026
- Unicode Technical Standard #39: Unicode Security Mechanismsunicode.orgRead 14 October 2026
See what is open before anyone else does.
We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.
- We read your firm from outside.
- You see what is open, with the proof for the lead finding.
- If it is worth it, you order.
What happens if you go ahead. More at getleaktrace.com/see-it-first/.
Read the transcript
- 72 hours. One domain. Nothing to install.
- Discover. Every way in, found from outside.
- Validate. Every finding, proven. Dated and checkable by anyone.
- Close. Forged email: one click per step, where we reach your DNS host and you approve it.
- You get the fix for the rest, step by step, and we re-check until it is closed.
- Monitor. On monitoring: email settings, look-alikes and new host names re-checked every hour. Alerts within the hour.
- Every paid assessment is human-verified before release.
- The AI defense layer for businesses. getleaktrace.com/see-it-first/