URL spoofing is the crafting of a web address that imitates a trusted destination while actually pointing to a site the attacker controls. The deception can sit in the registered domain, the subdomain, the URL scheme, or the browser's display of the address itself.
Attackers engineer a spoofed URL to read correctly to a human while resolving somewhere else entirely.
How URL spoofing works
The attack exploits the gap between what a URL says and where it resolves. A target receives a link that appears to lead to a legitimate site but instead lands on a spoofed website the adversary controls.
The simplest version swaps characters: the Cyrillic "a" (U+0430) is visually identical to the Latin "a" (U+0061), so an attacker can register a lookalike of apple.com whose real Punycode form (opens in new tab) is xn--pple-43d.com. The browser decodes the Punycode and renders the Unicode version, so the address bar shows a name the user recognizes.
Deception can also live in the URL's structure rather than its characters. Browsers parse the text before the final "@" as username data (opens in new tab) and use the hostname after it as the destination, so https://[email protected] (opens in new tab) opens phishing.com. Attackers abuse this parsing behavior alongside integer-based hostnames and other obfuscation formats.
Within the social engineering (opens in new tab) attack chain (opens in new tab), the spoofed URL is the delivery stage: the attacker registers lookalike infrastructure earlier, during weaponization, then distributes the link through email, SMS phishing (opens in new tab), paid ads, or messaging apps. Spoofing is the delivery mechanism; the phishing page waiting at the end is the exploit.
Why URL spoofing is hard to stop
Major URL-detection heuristics have documented bypasses (opens in new tab). In 2017, a security researcher registered a whole-Cyrillic domain (opens in new tab), xn--80ak6aa92e.com, that displayed as apple.com in Chrome, Firefox, and Opera. Chrome now ships whole-script confusable detection (opens in new tab), while whole-script confusables remain a residual gap under Mozilla's display algorithm (opens in new tab).
Hover inspection is unreliable: in the New Outlook client, the destination URL no longer appears (opens in new tab) on hover. HTTPS proves only encryption (opens in new tab), not identity, so a lookalike domain with its own certificate presents a secure connection while harvesting credentials.
Manual URL inspection (opens in new tab) fails against homographs and structural obfuscation, which make visual checks difficult (opens in new tab) even for trained users.
Attackers have also inverted the trust chain, routing malicious URLs through link-wrapping services (opens in new tab), hosted pages, and search-engine redirects so the first hop passes reputation checks. They pre-register plausible domains and move from registration to live malicious content quickly.
Types of URL spoofing attacks
Most spoofed URLs fall into a small set of technique families:
- IDN homograph attacks. Attackers register internationalized domain names using Unicode characters visually identical to ASCII. Several Cyrillic lowercase letters resemble Latin characters in many fonts.
- Typosquatting variants. Misspelled versions of the target domain, including doppelganger domains (opens in new tab) that drop a separating period, as in wwwgoogle.com.
- Combosquatting and subdomain spoofing. Attackers pair the brand name with a plausible keyword (opens in new tab) (paypal-verify.com) or place it as a subdomain of their own site. In paypal.com.attacker.com, attacker.com controls the destination.
- Userinfo ("@") obfuscation. Browsers read the text before the final "@" as username data and treat the hostname after it as the destination, so a trusted brand placed before the "@" masks the real site. Attackers often pair the trick with a shortened link to hide where the address resolves.
- Open redirect abuse. An unvalidated redirect parameter (opens in new tab) on a legitimate site forwards victims to attacker infrastructure. Because the link begins with a legitimate domain, the redirect lends the phishing destination borrowed trust.
- URL shortener and link-wrapper abuse. Shorteners hide the destination, and attackers chain them through email-security link wrappers so the visible link resolves through trusted scanning domains before reaching the attacker's page.
- Browser address bar spoofing. Implementation flaws (opens in new tab) can let a page display a false origin, leaving attacker-controlled content behind a trusted-looking URL.
How to defend against URL spoofing
Effective defense combines controls that remove attacker options with monitoring that surfaces lookalike infrastructure early:
- Lock down your own domains. A DMARC policy of p=reject (opens in new tab) tells recipient mail servers to reject mail that spoofs your domain; federal agencies operate under Binding Operational Directive 18-01. Parked and non-sending domains (opens in new tab) still need their own strict SPF and DMARC, or they become spoofing assets.
- Shrink the lookalike pool. Defensive registration (opens in new tab) of common misspellings, homoglyphs, and TLD variants takes the nearest permutations off the market before attackers can claim them.
- Close the credential path. For spoofed links that still reach users, phishing-resistant MFA helps: FIDO2 binds credentials to the TLS-authenticated domain (opens in new tab), so the browser offers them only to the site whose identifier matches.
- Watch registration and certificate activity. Certificate Transparency monitoring (opens in new tab) records newly issued TLS certificates in public logs, so keyword matching can surface lookalike domains before a campaign launches. Protective DNS (opens in new tab) blocks resolution of known-malicious domains, and continuous domain monitoring (opens in new tab) tracks newly registered permutations of your brand.
Detection only helps if response keeps pace, and this is where manual defense breaks down.
Registrar and host abuse queues work, but attackers pre-stage backup domains and rotate infrastructure faster than manual takedown workflows (opens in new tab) can clear them, so most credential theft (opens in new tab) happens before a takedown completes.
How Doppel helps
Doppel is the AI-native Social Engineering Defense (SED) platform that unifies Digital Risk Protection and Human Risk Management. Its Brand Protection (opens in new tab) product runs multi-channel detection (opens in new tab) across domains, paid ads, messaging apps, and email to catch URL-based impersonation (opens in new tab) and dismantle the attacker infrastructure behind it.
Doppel's agentic AI tracks permutation-style and parked lookalike domains and escalates them on state changes, while the Doppel Threat Graph (opens in new tab) connects each spoofed domain to the fake profiles, malicious ads (opens in new tab), and shared infrastructure (opens in new tab) behind it.
The agentic AI then executes coordinated multi-channel takedowns (opens in new tab) across registrars, hosts, social platforms, and ad networks, with analysts overseeing the cases it escalates. Because those takedowns reach the live domain and the backup infrastructure staged alongside it, they dismantle the attacker's fallback before it can be reused.
A demo walks through how the Threat Graph and agentic AI map and dismantle the spoofed-URL infrastructure targeting your brand. Request a demo (opens in new tab) to get started.
Frequently asked questions about URL spoofing
What is URL spoofing?
Attackers craft deceptive web addresses that look like trusted destinations while sending traffic to sites they control. The deception can live in the domain itself through lookalike characters or misspellings, in a subdomain before an "@" symbol, or in how the browser displays the address. Victims click because the link reads correctly at a glance, and the destination is built to harvest credentials and personal information, including payment data.
What is URL spoofing in cybersecurity?
In cybersecurity, URL spoofing is the delivery layer of impersonation campaigns: the fabricated link that carries a target to attacker infrastructure. No standards body defines it as a single term, so teams writing policy map its pieces to MITRE taxonomies. The relevant patterns fall within Resource Location Spoofing ( CAPEC-154 (opens in new tab)): Homograph Attack (CAPEC-632) (opens in new tab), Scheme Squatting (CAPEC-505) (opens in new tab), and TypoSquatting (CAPEC-630) (opens in new tab). Link-based delivery maps to T1566.002 (opens in new tab) in MITRE ATT&CK.
What is the difference between URL spoofing and domain spoofing?
Domain spoofing means faking a website's domain name or an email sender's domain, sometimes as a parent category covering website and email spoofing, sometimes as a synonym for website spoofing. URL spoofing describes deception anywhere in the URL string: the registered domain, but also subdomain placement, the "@" userinfo trick, shortened or wrapped links, and address-bar display flaws. Domain spoofing produces spoofed URLs, but URL spoofing can also ride on a genuine domain. An open redirect on a legitimate site, for instance, spoofs the URL while the domain itself is real.
What is an example of a URL spoofing attack?
In February 2026, the Starkiller phishing service (opens in new tab) generated URLs like login.microsoft.com@[malicious/shortened URL]. Browsers read the text before the "@" as a username and sent victims to the malicious destination, and the service then proxied the real login page (opens in new tab) to intercept credentials and MFA tokens; URL-structure spoofing combined with reverse-proxy phishing.