A domain that looks like https://t.co/ItCL8t345u but isn't https://t.co/ItCL8t345u where the actual characters are different.
Internationalized domain names (IDN) let browsers render non-Latin scripts, Cyrillic, Greek, Cyrillic lookalikes for Latin letters. а Cyrillic "а" (U+0430) looks pixel-identical to a Latin "a" in most fonts. so does Cyrillic "е," "о," "р," "с," "у," "х."
register "аррӏе.com" using Cyrillic characters, and browsers that support IDN will render it as https://t.co/ItCL8t345u in the address bar. underneath, the actual domain is https://t.co/NZco4fd9Qd punycode, the ASCII-safe encoding browsers convert IDNs into. you never see the punycode. you see https://t.co/ItCL8t345u. so does your email client. so does the padlock.
a researcher demonstrated this against Chrome and Firefox in 2017 using exactly that https://t.co/ItCL8t345u spoof, and both browsers rendered it clean.
the fix isn't "look closely." you can't. it's browsers flagging mixed-script domains, and you checking the punycode directly when something feels off.