It can be visually identical to the real domain.

https://www.kicksecure.com/wiki/Unicode

It's also happened with code pushes on GitHub, which didn't get caught in code review, and has compromised build processes by introducing a malicious domain that is visually identical.

Sounds like a HN-type problem.

https://www.knostic.ai/blog/zero-width-unicode-characters-ri...