https://аpple.com
What the eye is meant to trust: apple.com
One Cyrillic а replaces Latin a. The rest of the word is real.
Real: https://apple.com
Fake, shown above: https://аpple.com
Security for Distributed Systems and Crypto Assets
Universal Crypto Address Verifier
Anti-Spoof Shield
Anti-Spoof Shield is the application. CANON is the matching rule inside it.
Compare an intended address with the one on a hardware wallet or RBF screen, character by character. A matching prefix is not a match.
Opening X
Bank email: do not click the link
Never click a link in an email, no matter which company it claims to be, and no matter if it shows a blue check.
A blue check does not prove the link is safe. The account may only have paid for the badge, the display name may be fake, or a real official account may have been taken over. If you click, the browser opens their page. That page can take your password and the one-time code. The code is a single-use key: they use it to sign in and withdraw the money. They do not need to break your computer.
Copy the bank address you already saved. Copy the link in the email without clicking it. Paste the two strings into the two fields below.
Green means they are the same address.
Red means do not sign in, and do not enter the one-time code.
How the colors work
- Same code point: green.
- Different character: red.
- Looks the same but a different code point — case, Cyrillic, bold, 0/O, Roman numerals, or a hidden character: red too.
Comparison is case-sensitive. a and A are different characters. On Ethereum that case is the checksum.
Pasting the same string into both fields cannot catch an address you already copied from an attacker. Field B must come from the hardware wallet or Pi Wallet screen.
Attack lab
What the eye reads is not the string. Press Test. The shield loads both sides and names the defense that stopped it.
These are text samples, not links.
Fake website address
https://аррӏе.com
What the eye is meant to trust: apple.com
The whole name is Cyrillic: а р р ӏ е. It still reads apple.
Real: https://apple.com
Fake, shown above: https://аррӏе.com
https://xn--80ak6aa92e.com
What the eye is meant to trust: xn--80ak6aa92e.com
The bar may show Unicode. The copied string is xn-- punycode of that same fake apple.
Real: https://apple.com
Fake, shown above: https://xn--80ak6aa92e.com
https://[email protected]
What the eye is meant to trust: [email protected]
apple.com is only the username. The host is evil.test.
Real: https://apple.com
Fake, shown above: https://[email protected]
https://apple.com.evil.test
What the eye is meant to trust: apple.com.evil.test
apple.com is a label glued onto someone else's domain.
Real: https://apple.com
Fake, shown above: https://apple.com.evil.test
https://evil.test/apple.com
What the eye is meant to trust: evil.test/apple.com
The trusted name sits in the path. The host is evil.test.
Real: https://apple.com
Fake, shown above: https://evil.test/apple.com
https://rnodern.com
What the eye is meant to trust: modern.com
r and n side by side read as m in a small address bar.
Real: https://modern.com
Fake, shown above: https://rnodern.com
Fake X username
XOpen Beacon@ОpеnBеacоnWhat the eye is meant to trust: @OpenBeacon
Display name can stay honest. О, е, and о are Cyrillic copies of O, e, and o.
Real: @OpenBeacon
Fake, shown above: @ОpеnBеacоn
XOpen Beacon@𝐎𝐩𝐞𝐧𝐁𝐞𝐚𝐜𝐨𝐧What the eye is meant to trust: @OpenBeacon
Mathematical bold letters are not the ASCII username.
Real: @OpenBeacon
Fake, shown above: @𝐎𝐩𝐞𝐧𝐁𝐞𝐚𝐜𝐨𝐧
XOpen Beacon@OpenBeaconWhat the eye is meant to trust: @OpenBeacon
A zero-width character sits before the last letter. The handle looks unchanged.
Real: @OpenBeacon
Fake, shown above: @OpenBeacon
Lookalike examples
These pairs look alike and are not equal. The marked character is the spoof. Load a pair to inspect it.
Paste both addresses to inspect every character.
OpSec checklist
Address poisoning
A lookalike in your history shares the first and last characters. The middle is the attacker.
Homoglyph
Cyrillic, Greek, fullwidth, and Roman numerals can copy a Latin letter. 0/O and 1/l/I do it inside ASCII.
Clipboard hijack
Malware swaps the address after you copy it. The screen you sign is the one that matters.
RBF trick
A replace-by-fee prompt can show a different recipient. Compare that dialog, not the original tab.
Shield Supporter Badge
Optional 1 π tip. Verification stays free and on-device.