Typosquatting

The letters IP in “IP address” are short for Internet protocol. When included with a transmission control protocol (TCP), or higher-level protocol, it sets up a virtual connection between a source and its destination. The IP is part of an addressing system that by itself initiates the communication between the sender and recipient (like putting an address and a stamp on an envelope and depositing it in a mailbox), but the TCP/IP completes the connection between the two parties and allows them to exchange messages in the electronic world (like the post office delivering that letter). 

Well, what does all of this have to do with fraudulent behavior and identity theft? The answer is “A lot.” Organizations commonly will purchase additional domain names similar to the correct ones, so that if users are off by a few letters they’ll still get to the real thing — that’s good for the customers and the organizations. 

However, shady entrepreneurs will make money when misdirected victims click on advertising links set up on typosquatting sites that mirror popular organizations or businesses or divert visitors away from the competition and to their business web pages — that’s bad. 

A cyber criminal’s fraudulent site might include a phishing scheme that bilks personally identifiable information such as credit card or bank account numbers. That’s ugly.

And then there are the fraudsters who prey on victims who make innocent typing errors and end up on contaminated websites. The site looks familiar, you click on something, and malware downloads on your computer. You’re a victim of identity theft — that’s bad and ugly! Fraudsters have copied the home pages of legitimate organizations’ websites and included them on their contaminated websites. 

SCOPE AND RANGE OF TYPOSQUATTING 

How common is typosquatting? Internet Scambusters, in a 2008 study, “Beware of Typosquatting and new Identity Theft Warnings,” identified 80,000 typosquatting sites covering 2,000 frequently used websites. One popular website for kids yielded more than 300 criminal sites, and a major credit-reporting site contained nearly 750. 

Paul Ducklin, a computer security expert with the company, Sophos, recently investigated the scale and risk of the typosquatting industry and reported his findings in “Typosquatting — what happens when you mistype a website name?” on the Sophos Naked Security website. 

Ducklin applied “every possible one-character typo” of six popular domain names: Facebook, Google, Twitter, Microsoft, Apple and Sophos. He collected http data and browser screenshots from 1,502 websites and 14,495 URLs. He found the most typosquatting activities on these sites:  

• Advertising and popups: 15 percent.
• IT and hosting: 12 percent.
• Search: 6 percent.
• Cyber crime: 3 percent
• Adult and dating sites: 2 percent.

It makes sense that advertising and popup sites lead the list because, again, entrepreneurs (both good and bad) like to piggyback on the domain names of popular companies and create typosquatting sites to traffic their products or earn revenue click after click by advertising products for others. Of course, those who run the high-risk sites in the list — cyber crime and adult and dating — intend to present them as harmless. According to Ducklin, the cyber-crime sites “are associated with hacking, phishing, online fraud or spamming” activities.