The Simplest Science Behind Domain Similarity

When attackers try to fool you, they often start with domains that look nearly identical to the real thing. You’ve probably seen it in phishing attempts: an email that looks like it’s from your bank or a well-known brand, but the sender’s address is just a little off. “paypai.com” instead of “paypal.com.” At a glance, most people won’t notice. That’s exactly what attackers are counting on.

To spot these tricks, security researchers use a method called Levenshtein distance. It sounds complex, but it’s simply a way of measuring how similar two domain names are, and it’s one of the tools ThreatSTOP uses to proactively protect you.  Read on for this basic technique in computing.

What Is Levenshtein Distance?

Levenshtein distance measures how many edits it would take to turn one word into another. Edits can be:

• Adding a character

• Removing a character

• Replacing a character

Examples:

• google.com → gooogle.com (one extra “o”)

• netflix.com → netfli.com (one missing “x”)

• paypal.com → paypai.com (an “l” swapped for an “i”)

Attackers also rely on Unicode “homograph” domains—for example, swapping Latin letters with visually identical Cyrillic characters. ThreatSTOP normalizes these to punycode before scoring. That means раураl.com (with Cyrillic “р”) still shows a Levenshtein distance of 1, and is proactively blocked.

These one-edit domains are designed to deceive. ThreatSTOP makes sure they don’t get the chance.

Why It Matters to You

Attackers know people skim quickly. A single swapped letter is enough to trick someone into clicking, entering credentials, or downloading malware. Traditional blocklists may miss these variations, but similarity scoring closes that gap.

ThreatSTOP’s Security, Intelligence, and Research team applies this method to:

• Catch phishing domains early—before they’re widely reported

• Stop attackers from impersonating your brand

• Protect employees from accidentally visiting malicious sites

Regex vs. Levenshtein: Better Together

You may be familiar with regex (regular expressions). Regex is excellent at spotting known threats and exact patterns, but it struggles when attackers invent unpredictable twists.

Think of regex as a guard checking IDs against a list, while Levenshtein is the detective who notices suspicious behavior. Used together, they provide the strongest coverage.

Let's make it visual

Here's a simple visualization of how Levenshtein distance works, comparing the legitimate domain "paypal.com" and a sneaky impostor "paypai.com": 

The number at the bottom right corner (1) means there’s just one edit separating these domains-very suspicious! 

ThreatSTOP’s Approach

We’re rolling out similarity-based detection in a controlled way to deliver clear value.

• Protective DNS (DNS Defense Cloud and DNS Defense): Our platforms automatically stop access to malicious look-alike domains before a user ever reaches them.

• IP Defense: When phishing infrastructure is tied to IP addresses, our protections ensure your firewalls, routers, and cloud controls proactively block it.

You can expect:

• Simple activation: No complex setup.

• Clear visibility: See exactly why a domain was flagged.

• Control: Opt in to evaluate, and opt out if needed.

This feature is experimental today, but already proving powerful in real-world testing. Your feedback helps us refine accuracy while keeping false positives low.

Staying Ahead of Subtle Tricks

The message is simple: attackers thrive on subtle changes, but ThreatSTOP’s protections remove that advantage. By using domain similarity scoring alongside proven threat intelligence, we stop phishing campaigns before they succeed. Helping you stay protected without adding complexity to your security stack.

For those interested in joining the ThreatSTOP family, or to learn more about our proactive protections for all environments, we invite you to visit our product page. Discover how our solutions can make a significant difference in your digital security landscape. We have pricing for all sizes of customers! Get started with a Demo today!

Connect with Customers, Disconnect from Risks

MITRE ATT&CK Framework Mapping