What makes a fake website malicious. These websites are used to gain the users trust by looking like legitimate websites, but are actually created by criminals with malicious intent.
Below are a few examples compared to the legitimate website.

This PayPal website looks very similar to a legitimate website. However, notice the URL is incorrect. “Pay-pail.com” is a malicious site shown on the right. Source : https://www.verified.org/articles/scams/craigslist-paypal-scam
This second Example is for the clothing brand Joules.

Source: https://malwaretips.com/blogs/joules/
The URL for this website is “SKonlinesaleshop.com”. Not only did it closely resemble the actual brand website, but the URL did not match the official company domain. This website was spread over social media as well.
A third example is of a website offering “Antivirus” software posing as Avast. This could have easily manipulated people into trusting its content. Instead of getting a product, the download contained a malware payload that the users would install on their system. The URL for the fake site was : “ www.Avast-securedownload.com”

Source : https://www.trellix.com/blogs/research/a-catalog-of-hazardous-av-sites-a-tale-of-malware-hosting/