Typosquatting
An incorrectly entered URL could lead to a website operated by a cybersquatter.

Typosquatting, also called URL hijacking, a sting site, or a fake URL, is a form of cybersquatting, and possibly brandjacking which relies on mistakes such as typos made by Internet users when inputting a website address into a web browser. Should a user accidentally enter an incorrect website address, they may be led to any URL (including an alternative website owned by a cybersquatter).[1]

The typosquatter's URL will usually be one of five kinds, all similar to the victim site address (e.g. example.com):

  • A common misspelling, or foreign language spelling, of the intended site: exemple.com
  • A misspelling based on typos: examlpe.com
  • A differently phrased domain name: examples.com
  • A different top-level domain: example.org
  • An abuse of the Country Code Top-Level Domain (ccTLD): example.cm by using .cm, example.co by using .co, or example.om by using .om. A person leaving out a letter in .com in error could arrive at the fake URL's website.

Once in the typosquatter's site, the user may also be tricked into thinking that they are in fact in the real site, through the use of copied or similar logos, website layouts or content. Spam emails sometimes make use of typosquatting URLs to trick users into visiting malicious sites that look like a given bank's site, for instance.

Motivation

There are several different reasons for typosquatters buying a typo domain:

  • In order to try to sell the typo domain back to the brand owner
  • To monetize the domain through advertising revenues from direct navigation misspellings of the intended domain
  • To redirect the typo-traffic to a competitor
  • To redirect the typo-traffic back to the brand itself, but through an affiliate link, thus earning commissions from the brand owner's affiliate program.
  • As a phishing scheme to mimic the brand's site, while intercepting passwords which the visitor enters unsuspectingly[2]
  • To install drive-by malware or revenue generating adware onto the visitors' devices
  • To harvest misaddressed e-mail messages mistakenly sent to the typo domain
  • To block malevolent use of the typo domain by others
  • To express an opinion that is different from the intended website's opinion

Examples

Many companies, including Verizon, Lufthansa, and Lego, have garnered reputations for aggressively chasing down typosquatted names. Lego, for example, has spent roughly US$500,000 on taking 309 cases through UDRP proceedings.[3]

Celebrities have also frequently pursued their domain names, from singers to star athletes. Prominent examples include Basketball player Dirk Nowitzki's UDRP of DirkSwish.com[4] and actress Eva Longoria's UDRP of EvaLongoria.org.[5]

Since 2006, a typosquatted variant of Google called 'Goggle.com' has existed, but it now redirects to google.com.[6] Another example of corporate typosquatting is yuube.com, targeting YouTube users by having it programmed to redirect to a malicious website or page.[7] Similarly, www.airfrance.com has been typosquatted by www.arifrance.com, diverting users to a website peddling discount travel.[8] Other examples are Equifacks.com (Equifax.com), Experianne.com (Experian.com), and TramsOnion.com (TransUnion.com); these three typosquatted sites were registered by comedian John Oliver for his show Last Week Tonight.[9]

Users trying to visit the popular internet-based game Agar.io may misspell the said URL as agor.io. Visiting this site will produce a jumpscare or screamer of the popular creepypasta Jeff the Killer, which flashes rapidly and produces a loud noise.

In United States law

In the United States, the 1999 Anticybersquatting Consumer Protection Act (ACPA) contains a clause (Section 3(a), amending 15 USC 1117 to include sub-section (d)(2)(B)(ii)) aimed at combatting typosquatting.[10][11]

However, on April 17, 2006, controversial evangelist Jerry Falwell failed to get the U.S. Supreme Court to review a decision allowing Christopher Lamparello to use www.fallwell.com. Relying on a plausible misspelling of Falwell's name, Lamparello's gripe site presents misdirected visitors with scriptural references that are intended to counter the fundamentalist preacher's scathing rebukes against homosexuality. In Lamparello v. Falwell, the high court let stand a 2005 Fourth Circuit finding that "the use of a mark in a domain name for a gripe site criticizing the markholder does not constitute cybersquatting."

WIPO resolution procedure

Under the Uniform Domain-Name Dispute-Resolution Policy (UDRP), trademark holders can file a case at the World Intellectual Property Organization (WIPO) against typosquatters (as with cybersquatters in general).[8] The complainant has to show that the registered domain name is identical or confusingly similar to their trademark, that the registrant has no legitimate interest in the domain name, and that the domain name is being used in bad faith.[8]

See also

References

  1. ^ "Microsoft Strider project with screenshots of typosquatted domains". Research.microsoft.com. Retrieved . 
  2. ^ "'Typosquatting': How 1 mistyped letter could lead to ID theft". Bankrate. Retrieved 2016. 
  3. ^ "Internet". Domain Name Wire. 1 November 2011. 
  4. ^ "Internet". Domain Name Wire. 12 Sep 2011. 
  5. ^ "Internet". Domain Name Wire. 5 May 2011. 
  6. ^ Allemann, Andrew (2011-08-23). "Google Wants to Take Down Goggle.com Web Site". Domain Name Wire. Retrieved 2017. 
  7. ^ "Internet". The Times Of India. 5 May 2010. 
  8. ^ a b c Kelly M. Slavitt: Protecting Your Intellectual Property from Domain Name Typosquatters (2004)
  9. ^ http://www.mediaite.com/online/john-oliver-creates-fake-web-sites-to-troll-major-three-credit-bureaus/
  10. ^ "Anti-CyberSquatting Protection Act." US Library of Congress, Thomas.loc.gov, accessed 24 October 2008.
  11. ^ "Without typosquatters, how far would Google fall?" Cade Metz, The Register, Theregister.co.uk, accessed 24 October 2008.

External links



  This article uses material from the Wikipedia page available here. It is released under the Creative Commons Attribution-Share-Alike License 3.0.


Typosquatting
 



 

Connect with defaultLogic
What We've Done
Led Digital Marketing Efforts of Top 500 e-Retailers.
Worked with Top Brands at Leading Agencies.
Successfully Managed Over $50 million in Digital Ad Spend.
Developed Strategies and Processes that Enabled Brands to Grow During an Economic Downturn.
Taught Advanced Internet Marketing Strategies at the graduate level.


Manage research, learning and skills at defaultLogic. Create an account using LinkedIn or facebook to manage and organize your IT knowledge. defaultLogic works like a shopping cart for information -- helping you to save, discuss and share.


  Contact Us