Feature 1 β Homograph / typosquat / combosquat detection. BDR inspects the web address the moment you navigate (before the page even loads) and throws up a proceed-able amber warning if the address is pretending to be a known brand.
Numbers and look-alike characters swapped in for letters β they read like the real brand at a glance, but the skeleton matches the brand exactly. These are the classic "did you spot the trick?" domains.
Looks like paypal.com
The final "l" is the number 1.
Looks like microsoft.com
The "o" is a zero.
Looks like google.com
Both "o"s are zeros.
Looks like amazon.com
The "o" is a zero.
Looks like netflix.com
The "l" is the number 1.
Looks like facebook.com
Both "o"s are zeros.
The sneakiest kind. The address uses Cyrillic / Greek letters that look IDENTICAL to English ones. Your browser stores them as a weird xn--β¦ "punycode" address β which is what you'll see in the warning. Visually, on a real attack, you literally cannot tell.
Looks like paypal.com
The "a" is a Cyrillic Π° (real address is xn--pypal-4ve.com).
Looks like apple.com
EVERY letter is Cyrillic (real address is xn--80ak6aa92e.com).
Looks like google.com
Both "o"s are Cyrillic ΠΎ (real address is xn--ggle-55da.com).
The real brand name appears at the start of the address β but the part that actually owns the site (the bit right before .com/.xyz) is the attacker's. People read left-to-right and trust the brand they see first.
Looks like paypal.com
The real owner is secure-login.xyz β "paypal.com" is just a subdomain.
Looks like apple.com
The real owner is verify-account.top β "apple.com" is just a subdomain.
Looks like microsoft.com
The real owner is login-portal.ru β "microsoft.com" is just a subdomain.
The real brand spelled correctly, glued to a scary/urgent word like "secure", "login", "verify" or "support". Looks like an official sub-site, but it's a brand-new attacker domain.
Looks like an official paypal.com page
Brand "paypal" + lure word "secure" on a fake domain.
Looks like an official microsoft.com page
Lure word "login" + brand "microsoft" on a fake domain.
Looks like an official amazon.com page
Brand "amazon" + lure word "account" on a fake domain.
Looks like an official apple.com support page
Brand "apple" + lure word "support" glued together, no dash.
Looks like an official netflix.com page
Brand "netflix" + lure word "billing" on a fake domain.
Looks like an official coinbase.com page
Brand "coinbase" + lure word "wallet" on a fake domain.
A realistic typing mistake of the brand: a doubled letter, a dropped letter, two letters swapped, or a neighbouring-key slip. Attackers register these to catch people who fat-finger the address bar. (These score medium but still show the amber warning.)
Looks like google.com
An extra "o" (doubled letter).
Looks like google.com
The "le" is swapped to "el" (transposition).
Looks like amazon.com
"n" β "m" (the key right next to it).
Looks like microsoft.com
The "o" was dropped (omission).
Looks like linkedin.com
The "i" became an "l" (linkedin β linkedln).
Looks like paypal.com
The "a" was dropped (omission).
Control group. These are real, legitimate domains (or known-good brand products). If you see ANY amber warning when opening one of these, that's a false alarm = FAIL. Includes the v0.5.0 false-positive fixes that used to wrongly fire.
Real Amazon careers domain
v0.5.0 fix: "jobs" is NOT a lure word, so brand+jobs must not fire.
Apple ID product name
v0.5.0 fix: "id" is excluded as a lure word (collides with real Apple products).
Apple Pay product name
v0.5.0 fix: "pay" is excluded as a lure word.
Google Developers
v0.5.0 fix: "developers" is not a lure word β brand subsidiaries must not fire.
Real Apple-news site
"apple" is only a substring of an unrelated word β must not fire.
The REAL Google
Canonical brand domain β always allowed.
The REAL GitHub
Canonical brand domain β always allowed.
Google Play product name
Brand glued to a non-lure word ("play") β must not fire.
bdr/bdr-extension/src/features/phishing/homograph.js. It subscribes to
navigation events (fires on onBeforeNavigate, before DNS β so these fake
domains warn even though they don't resolve). A homograph hit is high severity but confidence-2,
so the arbiter shows the proceed-able amber WARN interstitial (same page as a block, but with a
"Proceed anyway" button) rather than a hard block. The SAFE group exercises the false-positive guards in
that file + src/data/brands.data.js (real-domain allowlist, excluded generic lure words
id/pay/app, and brand-as-substring guard).