Disclosed embodiments relate to improving network security through real-time analysis of character similarities. Techniques include identifying a reference name, identifying a domain name, and performing a real-time analysis of the domain name. The real-time analysis may include applying a language processing protocol to the domain name, generating a score indicating a similarity between the domain name and the reference name, accessing a similarity threshold, and comparing the generated score with the similarity threshold. Further techniques include determining that the score exceeds the threshold and performing a security action.