Phishing Domain Similarity Warning

WHAT IT DOES

Phishing Domain Similarity Warning is a DeFi security tool that watches the current page for domain names, URLs, and links, then compares them against a known list of legitimate domains using similarity algorithms (Levenshtein distance, homoglyph detection, and substring matching) to identify potential phishing domains. It scans the page for all domains and URLs, compares each against a customizable list of legitimate domains, calculates a similarity score based on multiple algorithms, and displays a visual warning overlay (high/medium/low risk) next to suspicious links or addresses based on the similarity score. The tool helps users identify phishing attempts that use lookalike domains, typosquatting, homoglyph attacks, and other impersonation techniques.

WHERE IT RUNS

This tool operates as a panel within the BotGentz browser extension, available for Chrome, Firefox, Edge, and Brave. It works on any webpage displaying domain names, URLs, links, or similar content. Common sources include social media platforms, email clients, DeFi dashboards, block explorers, and any site where users may encounter links or be prompted to connect their wallet.

HOW TO USE

Navigate to any page that displays domain names, URLs, or links. Open the BotGentz extension and select Phishing Domain Similarity Warning from the tool menu. The panel will appear on the side of your browser. Optionally, click the "Connect Wallet" button for enhanced features. Click the "Scan for Phishing Domains" button to analyze the current page. The tool will detect all domains, compare them against the legitimate domains list, and overlay a color-coded warning badge (red for high risk, yellow for medium, orange for low) next to suspicious links. You can customize the warning threshold, add your own legitimate domains, and choose the warning style (badge, highlight, or both). Use the "Clear Warnings" button to remove all overlays.

TECHNICAL SECTION — MULTI-ALGORITHM SIMILARITY DETECTION

This tool uses a multi-algorithm approach to detect phishing domains. First, it extracts all domains from the page by scanning link href attributes and text content using a regex pattern. Second, it compares each detected domain against a configurable list of legitimate domains using three complementary algorithms. The Levenshtein distance algorithm calculates the edit distance between domain strings, normalized by the maximum length, providing a baseline similarity measure. The homoglyph detection algorithm checks for character substitutions using a predefined homoglyph map (e.g., '0' for 'o', '1' for 'l', '3' for 'e') that are commonly used in domain impersonation. The substring matching algorithm detects domains that contain or are contained within legitimate domain names, identifying typosquatting patterns like "etherium" vs "ethereum." These three scores are weighted (60% Levenshtein, 25% homoglyph, 15% substring) and combined into a final risk score from 0 to 1. A configurable threshold (default 0.4) determines when to trigger a warning. The risk is categorized as high (>0.7), medium (>0.4), low (>0.15), or safe. The tool then overlays color-coded badges directly on the page next to the suspicious domains, providing immediate visual feedback to the user.

THE PANEL

The side panel is designed for seamless integration into your browsing workflow. You can drag it to either side of the window, and it remembers your preferred position per website. It supports snap-to-edge behavior and can be collapsed to a small tab for minimal distraction. The panel is resizable horizontally and vertically, with a minimum width of 280px and maximum of 600px. Pressing the Escape key closes the panel. All settings are saved locally.

PLEASE NOTE

This tool requires the free BotGentz extension. It works with EVM-compatible chains (Ethereum, Polygon, Arbitrum, Optimism, etc.) when the wallet connection is used for enhanced features. Cannot detect all phishing attempts; relies on a known list of legitimate domains which may be incomplete. Similarity algorithms may produce false positives/negatives. Cannot detect social engineering or context-based phishing. Requires the page to display domains in a detectable format. Does not guarantee safety. Always verify URLs manually. Websites change their page formats frequently, and extraction scripts may need periodic updates. This tool does not store or transmit page content except for the domains extracted from the page. No browsing history or personal data is collected or retained.