If domain names were presented in major to minor order when read left--to-right this would become a very obvious difference: https://uk.co.ee/ https://info.billing-update-jan02.uk.co.ee/ but obviously that is not going to happen I wonder if something could be auto-detected and flagged in the address bar UI. Say if the prefix for a domain matches in the top-1000 sites for a TLD (given that the sites people are most likely to want to spoof are popular). This could be done in the same way that the unsafe sites lists is sent to chrome browsers so that it is all browser side.