I've heard of phishing scams using misspellings of urls. But can a url look exactly the same as a legit one in the address bar, while actually being a different url?
But can a url look exactly the same as a legit one in the address bar, while actually being a different url?
Yes, that can occur. It's an advanced phishing technique known as IDN homograph attack.
Homographs (or homoglyphs) are characters that look very similar or even identical. When browsers started supporting internationalized domain names, it became possible to display non-latin characters in URLs, so you could theoretically mix different languages in one domain name.
Can you tell the difference between these?
a is actually cyrillic.)
As a response to homograph attacks, browser vendors have established their own IDN policies (e.g. Google Chrome, Mozilla Firefox). They mitigate the problem mostly by blacklisting potentially confusable characters and displaying URLs with non-latin symbols as Punycode under certain conditions. That's why your browser will display the first URL as
http://www.xn--exmple-4nf.com/ when you visit it.
Converting potentially misleading URLs while maintaining usability (e.g. you would still want to display a literal
ä to someone in Germany) has turned out to be somewhat elusive which is why even in 2017 there are still new homograph attacks being reported.