What this domain actually is HOMOGLYPH
There is no rendering of these two strings in which you can tell them apart, because the difference is in the bytes and the bytes are not on the screen.
The domains
Nothing here is resolved and no request of any kind is made. That matters more than it sounds: a domain under investigation is live infrastructure, and typing it into a checker tells that checker what is being investigated, and sometimes it tells the attacker.
The names it might be imitating
Each domain is reduced to a skeleton: every confusable character mapped to the one it imitates, marks stripped, and the pairs that impersonate a single letter folded in, so rn becomes m. Two names that reduce to the same skeleton look the same however different their bytes are.
What each one actually is
Every character is shown with its code point underneath. A character outside plain ASCII, or one that renders as nothing, is marked, and an invisible one is drawn as ␣ so there is something to point at.
The analysis
How it works
Some fake domains look identical to the real one because a letter has been swapped for a lookalike from another alphabet, and the difference is in the bytes, not on the screen. HOMOGLYPH shows what a domain really is: each character, which alphabet it comes from, its skeleton form, and tricks like rn standing in for m. It works offline and never looks the domain up, so checking a suspicious link does not visit it.
Doing this often? The Sovereign Console pulls every domain, address and indicator out of a whole case, and exports a report. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.