When you're at a point where you're relying on a display name to make security-critical decisions, you've already lost. Character substitutions like ķeepass or

When you're at a point where you're relying on a display name to make security-critical decisions, you've already lost. Character substitutions like ķeepass or ƙeepass or keypass are at least possible to spot if you know the name of the product, but not the full URL. But there are many ways to create lookalike domains that don't change the product name: https://keepass.org https://keepass.org https://keepass.net https://keepass.net https://keepass.info https://keepass.info https://keepass.cx https://keepass.cx https://keepassxc.org https://keepassxc.org https://keepass-info.net https://keepass-info.net https://keepass-manager.com https://keepass-manager.com Which of these is the correct one? (It's https://keepassxc.org https://keepassxc.org of course, but just looking at the URL won't tell you that.) The root cause is downloading software you see advertised on Google even though that does not in any way establish trustworthiness.