Doppelganger domain

A doppelganger domain is a deceptive domain made to resemble a domain a user already trusts. An attacker may use it in a spam link or other misleading content to send a victim to a fake destination. The danger is not only a misspelling: a convincing address can make a malicious site appear familiar before the user has checked who actually controls it. section 7.6 section 7.0

Common tricks include intentional typos such as amazzzon.com, similar-looking characters such as 0 for O or 1 for l, and misleading subdomains. Read a domain from right to left: www.google.com.etc.com is hosted under etc.com, not google.com. A familiar name on the left does not make the whole address trustworthy. section 7.6

Internationalized domain names can also enable a homograph attack, where a non-ASCII character resembles a Latin character. For example, a Cyrillic lookalike can replace the Latin a in a familiar-looking name. Modern browsers try to reduce this confusion by rendering some internationalized names as Punycode, depending on the user's language preferences. section 7.6

Reduce the chance that users encounter or follow harmful lookalike links:

• Filter harmful links in user-contributed content before presenting them as clickable destinations. section 7.13
• Use tools that detect lookalike domains, rather than relying only on users noticing subtle spelling or character differences. section 7.13
• Treat awareness campaigns as limited support: users who need the warning may still miss the technical details. section 7.6

function convertUrlsToLinks(comment, blocklist) {
  comment = escapeHtml(comment);

  // Find anything that looks like a link, check
  // it is safe.
  const urlRegex = /(https?:\/\/[^\s]+)/g;
  return comment.replace(urlRegex, (match) => {                   #1
    const url = new URL(match);
  

    if (blocklist.includes(url.hostname)) {                       #2
      throw new Error(`Blocked domain found: ${url.hostname}`);
    }

    return `<a href="${url.href}">${url.href}</a>`;               #3
  });
}

A link-rendering function escapes comment text, extracts HTTP URLs, and rejects a URL when its hostname appears in a blocklist before creating a link. This illustrates filtering user-contributed links, though a hostname blocklist only blocks names it contains. section 7.6 section 7.13