URL spoofing is a technique that makes a browser display a misleading web address or security cue, such as a trusted-looking domain, lock icon, or other trust signal. The goal is not always to change the real destination; it is to change what the victim believes they are visiting. Attackers may use lookalike domains, deceptive subdomains, hidden redirects, or browser UI bugs that alter how the address bar is rendered.
This matters because users often rely on the visible URL to decide whether a site is safe. If that signal can be faked, phishing pages can appear legitimate enough to capture passwords, approve payments, or bypass caution. Defenders treat URL spoofing as an interface-trust problem: keep browsers updated, verify the registrable domain rather than the surrounding text, and use phishing-resistant authentication such as passkeys or WebAuthn. In practice, the best defense is to assume the address bar is helpful, but not sufficient, proof of identity.