Vodou checks every address you navigate to — entirely on your device — for signs that it's impersonating a well-known brand:

  • Look-alike (homograph) domains using confusable characters, like a Cyrillic letter in paypal.com, or digit swaps like g00gle.
  • Mixed-alphabet or punycode domains — a single label mixing Latin with Cyrillic or Greek, or one that renders from a xn-- punycode form.
  • Typosquatting — a one-character misspelling of a well-known brand, like gooogle.

This check protects a curated list of the most commonly impersonated brands (big tech, mail, payments, banks, crypto) rather than the whole web, and is designed to stay quiet rather than raise false alarms.

The warning page

A suspected spoof is blocked before it loads, replaced by a full-page warning that names the brand being imitated, shows the deceptive address, and reveals its punycode "true spelling" — the one thing two identical-looking homograph domains can't share. Go back (safe) returns you to safety; Continue anyway trusts that one host for the rest of your session only (the warning returns on your next launch).

This check only runs on an actual navigation — a plain search term with no dot in it is never flagged, but clicking a search result that leads to a look-alike domain still is.