What Is Typosquatting And How Do Scammers Use It

What is Typosquatting and How Do Scammers Use it?

One typing error and you may be caught by typosquatters. While this may sound like a cyberpunk novel, it is a genuine cybersecurity threat. We explain what it is and how to avoid becoming a victim.

 

What is Typosquatting?

Typosquatting is a practice that involves modifying or mistyping domain names in order to trick users into visiting fraudulent websites. Threat actors employ a variety of typosquatting techniques. Naturally, they all benefit criminals and defraud another party. That someone else could be website visitors or the website's owners.

Domain name registration is at the heart of typosquatting. Threat actors register domain names that are extremely similar to the legitimate domain name they are impersonating, or they incorporate the legitimate name and modify it. You can register a domain name if it is not already registered. That is all.

If it can be demonstrated that the registration incorporates the name, product, or brand of another company and is likely to deceive the public or penalize the legitimate organization, the registration's ownership can be challenged. However, this occurs after registration.

Typosquatting is not synonymous with cybersquatting. Cybersquatters register domains that they anticipate or hope will be required by other organizations in the future. The domain names are not misspelled, altered, or deceptive in any way. They are standard domain names for which cybersquatters anticipate a future need.

For instance, if they learn that a studio is adapting a book for the screen, they may register a domain name incorporating the book's title. If the studio wishes to create a website for the film, it will discover that the domain name is already taken. They will either have to haggle with the cybersquatter or take legal action to acquire it.

Occasionally, this occurs by chance. A well-known case involved a businessman named Uzi Nissan. He had several businesses named after him in the 1980s. In 1997, he registered the domain nissan.com for his computer support business. After changing their name to Nissan, Datsun filed a lawsuit against Uzi Nissan, alleging trademark infringement and brand dilution and seeking $10 million in damages. Eight years of legal wrangling ensued. It was finally resolved in Mr. Nissan's favor in 2007—but not before he spent $3 million defending himself. Nissan Motor Company currently operates the website nissanusa.com.

Typosquatting is classified as a form of social engineering due to the fact that it is based on two human characteristics.

 

How Typosquatting Works

Typosquatting attacks are motivated by one of two human characteristics. One example is when people misspell a domain name. The other is that people will skim a domain name and will see what they expect to see.

 

Catching Typos

It's common for people to mistype things. Cybercriminals take advantage of this by registering domain names that are frequently misspelled variations of legitimate domain names. Each person who mistypes the domain name in a manner consistent with your misspelled domain name will be directed to your website, not the legitimate website. Cybercriminals frequently register a large number of domain names, capturing numerous variations on the genuine domain name's spelling.

This trap works because you are unaware you have made a typing error until the computer rejects what you have just typed. If you don't notice that you typed "amzon.com" instead of "amazon.com" and are taken to a website that looks identical to the Amazon landing page, you're likely to believe you've landed on the genuine Amazon website.

A typosquatting website can benefit typosquatters in a variety of ways. It is possible that:

• Mimic a Login Page: It will harvest login credentials and other personally identifiable information.
• Install Malicious Browser Extensions: It may infect your browser with malicious extensions such as keyloggers or adware.
• Download Malware: Your computer may be infected with malware such as remote access trojans or keyloggers.
• Redirect Traffic to Competitors: Visitors may be redirected to the website of a competitor.
• Affiliate Fraud: The bogus website may direct visitors to websites with which the typosquatters have affiliate relationships. Affiliate programs are used by websites to compensate partners who refer traffic to them. Each time someone is redirected to an affiliate website, the typosquatters are compensated a small fee. They register a slew of domain names, each of which is a misspelling of the legitimate website's domain name. Simply redirecting that to the legitimate website generates revenue for the typosquatters.
• Mimic Download Pages: Typosquatting websites may imitate software download pages, such as those for open-source projects. Instead of the genuine software libraries and developer toolkits, website visitors download tainted versions. The fraudulent toolkits and libraries are integrated into the victims' own products, transforming them into a vehicle for the threat actors' trojans, malware, and backdoors.
• Promote an Ideology: The typosquatting website may paint an unfavorable, misleading, or embarrassing picture of the actual organization. This is conducive to hacktivism.
• Extortion: Typosquatters may attempt to extort the genuine domain name owner by offering to sell the typosquatted domain name.

 

Creating Links That Appear to Be Similar

The other type of typosquatting is when domain names are registered that are visually similar to the legitimate domain name. These are used in phishing email campaigns as links.

Because the fake domain name must appear to be the genuine domain name, it is carefully constructed to pass a quick glance. Typosquatters employ the following types of trick:

• Mimic Letters: Using letters or digits to create the appearance of other letters. If you skim it, "rnicrosoft.com" appears to be "microsoft.com," and "apqle.com" appears to be "apple.com."
• Insert Foreign Characters: This is a more subtle method of mimicking letters, dubbed IDN homograph attacks. Greek letters such as alpha "" and omega "" are notoriously difficult to spot in a typosquatting domain name. If you were unaware, these two links would likely raise no suspicions:
• cloudsvvyit.com: There is no "a" in "savvy."
• Incorrect TLD: The top-level domain may be incorrect. Domain names such as "cloudsavvyit.org" or "cloudsavvyit.net" are persuasive because they contain no strange characters and are spelled correctly.
• Adding Words: Words associated with the genuine site's content can be used to mask typosquatting domain names, for example, "technews-howtogeek.com."
• Removing Letters: A domain name can be subtly trimmed to retain the appearance of a viable domain name: "cloudsavvy.com." The word "it" is omitted.
• Add Periods: Another simple modification that may go unnoticed is adding periods to the domain name. Links are frequently italicized. This makes identifying the inserted periods more difficult: "cloud.savvyit.com."
• Removing Periods: By registering a domain name such as "wwwhowtogeek.com," you can trick people into clicking a link> It contains all of the expected components, except for a period.

Because these links pass one of the recommended tests, they are particularly effective in phishing campaigns. Staff are frequently instructed to hover their mouse pointer over an email link before clicking it. A tooltip or other on-screen notification will inform them of the link's destination. If this matches the email's content and the link's wording, it is likely to be trusted.

 

How To Protect Your Organization

Perhaps you are already a victim of typosquatting. You can verify this using dnstwister.report.

You can register typosquatting domain names in advance to prevent others from using them against you.

Certain internet service providers include anti-typosquatting protection in their offerings. If a user in your organization misspells a common domain name or clicks a link that contains a look-alike domain name, they will be denied access to the site. A warning page will inform them of the reason.

Keep an eye on your website's traffic statistics. If it suddenly decreases, this could be a sign that some of your traffic is being diverted to a typosquatting website.

Consider establishing and operating an in-house Domain Name System server.

Unless they are on a genuine domain, password managers will not offer to enter login credentials. They will not be fooled into logging in by typosquatting websites.

Additionally, awareness is a significant component of the solution. Knowing these traps exist aids in their detection, so don't forget to update your staff.