---
title: "Comment by Furqan Ashraf on \"Spot Lookalike Phishing Domains in Python: Punycode, Homoglyphs and Typos in ~140 Lines of Stdlib\" | Hashnode"
description: "Rating edit-distance-1 as MEDIUM and leaving it to a human is the right call. The question for that human usually isn't \"does this look like our brand\", since c"
url: "https://hashnode.com/posts/spot-lookalike-phishing-domains-in-python-punycode-homoglyphs-and-typos-in-140-lines-of-stdlib/6aea881fb1a847fe28b58ed4/comment/6af3f2f2fa31e6ed2f035f5c"
---

[Discussion](https://hashnode.com/posts/spot-lookalike-phishing-domains-in-python-punycode-homoglyphs-and-typos-in-140-lines-of-stdlib/6aea881fb1a847fe28b58ed4)

Comment [Spot Lookalike Phishing Domains in Python: Punycode, Homoglyphs and Typos in ~140 Lines of Stdlib](https://hashnode.com/posts/spot-lookalike-phishing-domains-in-python-punycode-homoglyphs-and-typos-in-140-lines-of-stdlib/6aea881fb1a847fe28b58ed4)

[Furqan Ashraf](https://hashnode.com/@jfreaks)

[18h ago](https://hashnode.com/posts/spot-lookalike-phishing-domains-in-python-punycode-homoglyphs-and-typos-in-140-lines-of-stdlib/6aea881fb1a847fe28b58ed4/comment/6af3f2f2fa31e6ed2f035f5c)

Rating edit-distance-1 as MEDIUM and leaving it to a human is the right call. The question for that human usually isn't "does this look like our brand", since `check()` already answered that. It's "does this name exist and do anything". A MEDIUM that isn't registered is a note for later. One registered last week with MX records and a certificate is something to act on today.

That part needs live data, so it can't sit in a stdlib-only script. For the review step you can query RDAP for the creation date (rdap.org redirects to the right registry) and run `dig MX`, or use something that bundles both. We built [Ask WhoisFreaks](https://ask.whoisfreaks.com/) for this kind of one-off question (I work on it): "is paypa1-support.com registered, and is it on any threat feed?" gets WHOIS, DNS, SSL and feed results in one answer. It's a chat tool, so for scoring every MEDIUM inside CI you'd want an API call instead.