Domain deception is a core tactic used in phishing attacks, where attackers craft URLs to appear legitimate and trick users into interacting with malicious sites. This manipulation of URLs can lead to stolen credentials, financial fraud, or malware installation. Understanding how attackers manipulate domains is crucial for spotting phishing attempts. Here are the most common techniques:

• Typosquatting: Attackers register domains that closely resemble legitimate ones, relying on users mistyping a web address. For instance, instead of “paypal.com,” a phishing link might be “paypa1.com” or “paypol.com.” A minor misspelling can go unnoticed, especially in situations where users are rushed or distracted. These slight differences allow attackers to deceive users into thinking they are visiting the correct website.
• Subdomain Spoofing: Attackers can manipulate subdomains to make URLs appear legitimate. For example, a URL like “secure.login-paypal.com” might look like it's connected to PayPal, but the actual domain is “login-paypal.com”, which could be owned by the attacker. Users often trust subdomains like "secure" or "login," making this tactic highly effective in phishing attempts.
• Use of Internationalized Domain Names (IDN) Homograph Attacks: Phishers exploit characters from non-English alphabets that resemble English letters. This is known as an IDN homograph attack. For instance, the Cyrillic letter "а" is visually similar to the Latin "a." A URL like “xn--pple-43d.com” could be disguised as “apple.com,” tricking users into believing they are on a legitimate site.
• URL Shortening Services: Attackers use URL shortening services, such as bit.ly or tinyurl.com, to obscure the destination of a malicious link. Users are unable to see the full URL and might click on the shortened link without realizing it leads to a harmful site. This method adds a layer of anonymity and disguises the true intent of the URL.
• HTTPS and SSL Deception: Many users mistakenly believe that a padlock icon or “https” in the URL means a site is completely safe. Attackers exploit this by obtaining legitimate SSL certificates for their fake domains. For example, “https://secure-update-paypal.com” may appear secure because of the SSL certificate, but it is still a fraudulent site. Users are more likely to trust these fake sites, especially when they see the padlock symbol or “https” in the browser.
• Domain Lookalikes and Visual Deception: Attackers create visually similar domains by adding/removing characters, using hyphens, or swapping letters. Examples include “faceb0ok.com” instead of “facebook.com” or “google-secure-login.com” instead of “google.com.” This visual deception makes it easier to trick users who glance at the URL without examining it closely.