{"id":2346,"date":"2019-01-21T12:09:14","date_gmt":"2019-01-21T12:09:14","guid":{"rendered":"https:\/\/www.varutra.com\/blog\/?p=1768"},"modified":"2022-12-02T15:26:54","modified_gmt":"2022-12-02T09:56:54","slug":"security-advisory-typosquatting","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/security-advisory-typosquatting\/","title":{"rendered":"Security Advisory – Typosquatting"},"content":{"rendered":"

<\/p>\n

There are multiple cases of redirect which are due to typing mistake (typos) from the users which leads to the threat of getting infected with cryptomining malwares, malware alerts, misleading messages, spams, etc. Such type of human typing error is called as Typosquatting.<\/p>\n

Typosquatting, also called URL hijacking, a sting site, or a fake URL, is a form of cybersquatting, and possibly brandjacking which relies on mistakes such as typos made by Internet users when inputting a website address into a web browser. Should a user accidentally enter an incorrect website address, they may be led to any URL (including an alternative website owned by a cyber-squatter).<\/p>\n

The typosquatter’s URL will usually be one of five kinds, all similar to the victim site address
\n(e.g. example.com):<\/p>\n

1. A common misspelling, or foreign language spelling, of the intended site:
\n(exemple.com).
\n2. A misspelling based on typos: (examlpe.com).
\n3. A differently phrased domain name: (examples.com).
\n4. A different top-level domain: (example.org).
\n5. An abuse of the Country Code Top-Level Domain (ccTLD): example.cm by using .cm,
\nexample.co by using .co, or example.om by using .om.<\/p>\n

A person leaving out a letter in .com in error could arrive at the fake URL’s website. Once in the typosquatter’s site, the user may also be tricked into thinking that they are in fact in the real site, through the use of copied or similar logos, website layouts or content. Spam emails sometimes make use of typosquatting URLs to trick users into visiting malicious sites that look like a given bank’s site, for instance.<\/p>\n

 <\/p>\n

There are several different reasons for typosquatters buying a typo domain:<\/h3>\n

1. In order to try to sell the typo domain back to the brand owner.
\n2. To monetize the domain through advertising revenues from direct navigation
\nmisspellings of the intended domain.
\n3. To redirect the typo-traffic to a competitor.
\n4. To redirect the typo-traffic back to the brand itself, but through an affiliate link, thus
\nearning commissions from the brand owner’s affiliate program.
\n5. As a phishing scheme to mimic the brand’s site, while intercepting passwords which the
\nvisitor enters unsuspectingly.
\n6. To install drive-by malware or revenue generating adware onto the visitors’ devices.
\n7. To harvest misaddressed e-mail messages mistakenly sent to the typo domain.
\n8. To block malevolent use of the typo domain by others.
\n9. To express an opinion that is different from the intended website’s opinion.<\/p>\n

Many of these sites which are ending in .com, but also .ne, .cm, .om, things that are easily typed incorrectly.<\/p>\n

Espn[.]cm is one of more than a thousand so-called \u201ctyposquatting\u201d domains hosted on the same Internet address 85[.]25[.]199[.]30. The IP Address \u201c85[.]25[.]199[.]30\u201d is resolving to 1,170 Domains. A list of the most popular typosquatting domains that are part of “Espn[.]cm” is listed below:<\/p>\n

\"Typosquatting<\/a><\/p>\n

All of the domains currently redirect visitors to just one of two landing pages \u2014 either antistrophebail[.]com or chillcardiac[.]com<\/p>\n

For the moment, if one visits either of these domains directly via a desktop Web browser chances are the site will display a message saying, \u201cSorry, we currently have no promotions available right now\u201d. Browsing some of them with a mobile device sometimes leads to a page urging the visitor to complete a \u201cshort survey\u201d in exchange for \u201ca chance to get a gift cards, coupons and other amazing deals!\u201d<\/p>\n

 <\/p>\n

Recommendations To Avoid Typosquatting :<\/strong><\/h3>\n

1. Everyone makes typos from time to time, which is why it\u2019s a good idea to avoid directly
\nnavigating to Web sites you frequent visit.
\n2. Enforcing use of bookmark the sites you visit most, particularly those that store your
\npersonal and financial information, or that require a login for access.
\n3. Blocking all Web sites in a given top-level domain, this will block anything coming out of
\ndot-cm.
\n4. Varutra recommends blocking the following 50 TLD’s and above mentioned IP Addresses
\n\/URL\u2019s which are associated primarily with this kind of activity.<\/p>\n

\"\"<\/a><\/p>\n

References:<\/strong><\/h3>\n
    \n
  1. https:\/\/krebsonsecurity.com\/2018\/03\/omitting-the-o-in-com-could-be-costly\/<\/a><\/li>\n
  2. https:\/\/blog.infostruction.com\/2018\/03\/21\/wrong-spelling-brand-name-hijack\/<\/a><\/li>\n<\/ol>\n

     <\/p>\n

    Author,<\/p>\n

    Umang\u00a0G. Waghmare<\/strong><\/div>\n
    SOC Team<\/div>\n
    Varutra Consulting<\/em><\/div>","protected":false},"excerpt":{"rendered":"

    There are multiple cases of redirect which are due to typing mistake (typos) from the users which leads to the threat of getting infected with…<\/p>\n","protected":false},"author":3,"featured_media":3109,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[140,270,266,273,271,267],"tags":[174,175,127,176,177,178,179,180],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t