Checking domains and dates

Why it matters

Two of the cheapest tricks online need no Photoshop and no bots. The first is a lookalike domain: a site whose address differs from a real newspaper’s or bank’s by one letter, one dot or one extra word. Since 2022 the Doppelganger campaign, documented by EU DisinfoLab and later sanctioned by the EU, has cloned dozens of European outlets this way, right down to the fonts, to publish articles those outlets never wrote (see cloned news sites). The same trick runs most phishing.

The second trick is older: a real article, shared years later as if it were today’s news. The factory closure from 2016 becomes “breaking”. The outrage is real; the event is not current. Both tricks fall apart in under a minute if you look at the two things nobody looks at: the address bar and the dateline.

How to do it

1. Read the domain from the right. The part that matters sits directly before the first single slash, read backwards: the ending, then the name. news.bbc.co.uk/... is the BBC; bbc.co.uk.breaking-report.live/... is breaking-report.live wearing a costume. Everything to the left of the real domain is decoration.
2. Read it letter by letter. rn looks like m, a capital I looks like a lowercase l, .co is not .com, and -news, -live or -today tacked onto a familiar name is a different site. Phones hide most of the address bar; tap it to see the whole thing.
3. Unmask short links. A bit.ly or t.co link can go anywhere. Add a + to the end of a bit.ly link to see its destination before visiting, or paste it into a link-expander. In messaging apps, long-press the link to preview the real URL.
4. Check the domain’s age. Paste it into ICANN Lookup. The owner is often hidden, but the registration date is not. A “national news network” registered six weeks ago is a flag; an outlet with twenty years of archive is a different kind of thing. For .hu domains, the registry at domain.hu has its own search.
5. Find the article’s own date. It is usually under the headline, sometimes in the URL (/2019/03/). Compare it with when the post was shared. If the page has no date at all, or the date looks edited, the Wayback Machine shows how the page looked over time, and whether it existed at all last week.

Example

@truth_now_daily, 2h Even the mainstream admits it now. The country’s biggest daily: “Government to cut pensions by 15% from January”. Read it before they take it down: dailypaper-news.co/pensions-cut

Steps one and two: the real paper’s domain ends in .com; this one is dailypaper-news.co, with an extra word and a different ending. Not a subdomain of anything. Not the paper.

Step four: ICANN Lookup says dailypaper-news.co was registered 19 days ago. Step five: the page carries no date and no author, and the Wayback Machine has no snapshot of it before this week.

Then the content, briefly: the “article” copies the real paper’s layout and a real reporter’s byline, but the paper’s own site has no such story and its search returns nothing. The whole thing is a costume. The right comment is calm and specific: “That’s not the paper’s domain. Theirs is .com, this is a 19-day-old lookalike. Here’s the lookup.” Note what you did not need: an opinion about pensions. If the story were real, the real site would have it. See also fake screenshots, the same trick without the domain.

Common mistakes

• Trusting the look of the page. Fonts, logos and layout copy in seconds. The address bar does not.
• Reading the domain from the left. paypal.com.secure-login.xyz is not PayPal. Find the real domain just before the first slash and read right to left.
• Clicking “just to see”. On a lookalike site, seeing is the trap; the page exists to make you log in or install something. Check first, then click (or don’t).
• Assuming “no date” means “today”. It usually means “evergreen bait”. An undated story is a story with something to hide, and the Wayback Machine will often find the original with its date intact.
• Treating a young domain as proof. New sites exist. A six-week-old domain is a reason to check who is behind it, not a verdict on its own. Pair it with a quick lateral read.