The Translator's False Cognate: On the Deliberate Deception of the Malicious Redirect
We often speak of redirects as tools of order and compassion—the librarian gently guiding a patron to the correct shelf, the concierge offering a master key to a new room. We frame them as a courtesy, a seamless hand-off in the user’s journey. But what of the redirect that lies? The one that wears the familiar face of a friend only to lead you into a back alley? This is the story of the malicious redirect, the false cognate of the digital lexicon.
A false cognate, in language, is a word that appears similar across tongues but shares no common ancestry or meaning. To an English speaker learning Spanish, ‘embarazada’ looks like ‘embarrassed,’ but it means ‘pregnant.’ The result of trusting the similarity is a profound, often humorous, miscommunication. The malicious redirect operates on precisely this principle of deceptive familiarity. It presents a URL that looks trustworthy, perhaps a common misspelling of a popular site or a shortened link that obscures the true destination. You think you’re clicking through to a news article or a video, but the hand you’ve taken belongs to a stranger.
This deception is deliberate, crafted not for preservation or user experience but for exploitation. The architecture is simple: acquire a domain, often one that has lapsed and carries some residual trust, or create a new one that is a hair’s breadth from a legitimate address. Then, build a trap. The redirect is the sprung mechanism, the moment the user’s trust is weaponized against them. It’s a digital bait-and-switch, where the promise of one location is broken instantly, rerouting to a page hosting malware, phishing scams, or manipulative advertising.
Fighting this requires a different kind of vigilance than we apply to our own site structures. It’s not about pruning or mapping our own garden; it’s about learning to identify the poisonous plants growing just beyond the fence. For users, it demands a skepticism of too-good-to-be-true links and a careful eye on the address bar the moment a page loads. For site owners, it involves protecting your own brand’s digital real estate—registering those common misspellings yourself not to use them, but to neuter them, pointing them safely back to your home page to deny adversaries the foothold.
The malicious redirect is a corruption of a fundamental web function. It takes the concept of a pathway and twists it into a snare. It reminds us that no tool is inherently good; its morality is defined by the hand that wields it. In the vast, interlinked structure of the web, these false paths are the dark corners we must learn to spot, the deceptive words in a global conversation where a single misplaced click can change the entire meaning.
Notes & further reading
A few pages I came back to while writing this: