First CH Apps / Lookalike Domain Checker
Paste the sender's email address and we compare it with your vendors' domains to catch lookalikes: romanization variants, swapped TLDs, one-letter changes, look-alike characters and more.
Five questions with fictional vendors (.example). Decide whether each sender is the same vendor or a lookalike.
When an email asks you to change bank details or pay an invoice, compare everything after the @ with the vendor's real domain. This page sorts the sender into four verdicts — exact match, same registered domain with a different subdomain, lookalike, no match — and for a lookalike it lines up the closest vendor and colours the letters that differ. The check runs on your device, so the result appears the moment you press the button.
The sender writes the display name (“Accounts”) themselves. What matters is the real address inside < >, after the @. We compare that whole host, and separately work out the registered domain (the unit you buy, like example.co.jp) to tell subdomains apart from lookalikes.
新橋 can be written shimbashi, shinbashi or sinbasi. Hepburn vs. Kunrei, n vs. m before b, and long vowels (ou vs. o) are easy to miss even when you know the vendor's real spelling.
If a vendor's mailbox is taken over, fake bank details arrive from the real domain. Confirm any change of amount or bank details by phone, whatever the verdict here.
The comparison (the four verdicts and the lookalike patterns) runs inside this page, on your device. Neither the sender's address nor your vendor list is sent to our server for it. Only when JavaScript is turned off in your browser are the sender and vendors you typed sent to our server, which runs the comparison there and returns the result (nothing is stored).
What is sent: only the domain after the @, so we can look up its registration date and MX afterwards. Our server (Cloudflare Workers) queries the IANA RDAP bootstrap, the registry's RDAP service and Cloudflare's public DNS over HTTPS. We never receive message bodies or headers.
Stored: nothing on the server. No database (KV/D1) is written, and everything leaves memory when the request ends. Your vendor list lives only in this browser's localStorage and disappears with “Clear all” or when you clear browser data. Test scores are not stored.
We never read registrant names or contacts, and we do not fetch the other site, monitor domains over time or generate lists of similar domains.
POST /lookalike-domain/api/check with JSON ({"sender": "billing@example.com", "trusted": ["example.com"]}) and you get the verdict, registration date and MX as JSON (trusted is optional, up to 50; no auth, nothing stored).
