Академический Документы
Профессиональный Документы
Культура Документы
iMinds-DistriNet, KU Leuven,
{firstname}.{lastname}@cs.kuleuven.be
Department of Computer Science, Stony Brook University,
nick@cs.stonybrook.edu
AbstractTyposquatting is the act of purposefully registering
a domain name that is a mistype of a popular domain name.
It is a concept that has been known and studied for over 15
years, yet still thoroughly practiced up until this day. While
previous typosquatting studies have always taken a snapshot of
the typosquatting landscape or base their longitudinal results
only on domain registration data, we present the first contentbased, longitudinal study of typosquatting. We collected data
about the typosquatting domains of the 500 most popular sites of
the Internet every day, for a period of seven months, and we use
this data to establish whether previously discovered typosquatting
trends still hold today, and to provide new results and insights
in the typosquatting landscape. In particular we reveal that,
even though 95% of the popular domains we investigated are
actively targeted by typosquatters, only few trademark owners
protect themselves against this practice by proactively registering
their own typosquatting domains. We take advantage of the
longitudinal aspect of our study to show, among other results,
that typosquatting domains change hands from typosquatters
to legitimate owners and vice versa, and that typosquatters
vary their monetization strategy by hosting different types of
pages over time. Our study also reveals that a large fraction of
typosquatting domains can be traced back to a small group of
typosquatting page hosters and that certain top-level domains are
much more prone to typosquatting than others.
I.
I NTRODUCTION
B. Data Gathering
To gather the data required for our longitudinal study, we
set up two automated crawlers, which where supplied with
the Alexa top 500 domains of April 1, 2013 as input. The
first crawler generates the typosquatting domains for each
authoritative domain in the input, according to the aforementioned models. For each authoritative and generated domain,
the crawler first determines whether the domain resolves to an
IP address. If so, the crawler visits the web page hosted on the
domain using PhantomJS1 , a headless JavaScript-enabled web
browser. After loading the web page, the crawler waits for 10
seconds, allowing the page to load dynamic content or perform
a redirect. Finally, the crawler saves the IP address, final URL,
HTML body and a screenshot of the page to disk. The crawler
was configured to process the entire list of domains daily, for a
period of 7 months starting at April 1, 2013 and running until
October 31, 2013. The crawl was duplicated onto a second
machine to provide redundancy in case of system failure. In
order to prevent excessive resource usage and to minimize
the chance of our crawlers being blocked by typosquatting
domains, duplicate typosquatting domains were filtered out
and the rate at which the crawlers visit domains was set to the
minimum value that still allows a crawl to finish within a small
margin of 24 hours. In total, 28,179 potential typosquatting
domains were generated, out of which 17,172 resolved to an
IP address at least once during our study.
We provide new results and insights in the typosquatting landscape, based on both the static and longitudinal aspects of our data.
The rest of this paper is structured as follows. In Section II, we provide background information on typosquatting
in general and on the way our data gathering experiment
was set up. Section III describes the main results found by
our experiment. Section IV describes related work and finally
Section V concludes.
II.
BACKGROUND
A. Typosquatting Models
5)
C. Analysis
Our crawlers collected over 900 GB worth of data during
the data gathering period, consisting of 3,389,137 web pages
and 424,278 distinct WHOIS records. In order to analyze
this data, we classified the collected pages into the categories
listed in Table I. The third column of this table indicates for
each category whether we consider it a legitimate, malicious
or undetermined use of a domain name. Although most of
1 http://phantomjs.org/
2 http://ruby-whois.org/
TABLE I.
T HE COLLECTED TYPOSQUATTING PAGES WERE CLASSIFIED INTO CATEGORIES , BASED ON THE MOST LIKELY INTENT OF THE PAGE . T HE
THIRD COLUMN INDICATES THE CATEGORY TYPE : L STANDS FOR LEGITIMATE , M STANDS FOR MALICIOUS AND U STANDS FOR UNDETERMINED .
Category
Description
Authoritative
Coinciding
Protected
Ad parking
Adult content
Affiliate abuse
For sale
Hit stealing
Scam
No content
Server error
Crawl error
Other
L
L
L
M
M
M
M
M
M
U
U
U
U
R ESULTS
On the defense side, trademark owners can protect themselves against typosquatting by proactively making defensive
typosquatting domain registrations whenever they register an
4
Malicious
Defensive
60
50
40
30
20
10
0
ar
Ch
ar
Ch
ar
si
ar
Ch
Ch
is
su
t
bs
rm
pe
do
pl
du
ng
om
70
D. Typosquatting Models
To investigate to what degree typosquatters and legitimate
domain owners are aware of the different models that can
be used to generate typosquatting domains, we calculated the
6
100
All models
No char subst
80
60
40
20
0
9 10 11 12 13 14 14+
100
80
60
40
20
0
1-100
101-200
201-300
301-400
401-500
Alexa rank
Fig. 5. Domains with short names suffer more from typosquatting, but this
effect is not nearly as outspoken as in the 08 results of Banerjee et al. [2].
Fig. 6. Our data shows no significant correlation between Alexa rank and
saturation.
the saturation within each rank bin varies widely and shows
no significant correlation between rank and saturation. This
contradicts the 08 results of Banerjee et al. [2], which indicated that the percentage of active typosquatting domains
for a given authoritative domain reduces significantly with
decreasing popularity, reaching only about 20% for the domain
ranking 500 in their list of authoritative domains. Our results
hence indicate typosquatters have started focusing on lower
ranking domains in the past six years, in addition to the
top ranking domains. These results are consistent with the
recent findings of Szurdi et al. [23], who investigated the
typosquatting activity for all .com domains in the Alexa
top 1 million. Their study indicates that, although there is
a positive correlation between typosquatting saturation and
authoritative domain popularity, the typosquatting saturation
is still at 40% near the Alexa 1 million rank.
These results indicate that typosquatters have started targeting longer authoritative domains in the past six years. The most
likely reason for this is that most short typosquatting domains
were already in use: the figure illustrates that the average
typosquatting saturation for domain names up to 8 characters
is over 75%. A large fraction of the possible typosquatting
domains of relatively short, popular websites is hence already
registered.
40
30
20
10
0
Probability
50
6000
5500
5000
4500
4000
3500
3000
2500
2000
1500
1000
500
0
Legit-malicious transitions
60
1
0.9
0.8
0.7
0.6
0.5
0.4
0.3
Legitimate domains
Malicious domains
1
10 11 12 13 14
3
-4
42 1
-4
40 9
-3
38 7
-3
36 5
-3
34 3
-3
32 1
-3
30 9
-2
28 7
-2
26 5
-2
24 3
-2
22 1
-2
20 9
-1
18 7
-1
16 5
-1
14
Week of 2013
Fig. 7. The number of category transitions per domain. The two bottom
lines use the left Y-scale, the top line uses the right Y-scale. Domains are
moving from typosquatters to legitimate owners and vice versa, and are often
changing category while being malicious.
Number of domains
10000
1000
100
10
1
0
10
20
30
40
50
60
70
80
The two bottom lines of this figure refer to the lefthand Y-scale and show the total number of malicious to
legitimate or legitimate to malicious transitions. During our
study, we saw an average of about 3 malicious-to-legitimate,
and about 2 legitimate-to-malicious transitions per week.
These numbers indicate legitimate owners are taking over
domains from typosquatters and vice versa, albeit not in great
numbers. With the exception of one domain, all domains
that moved from malicious to legitimate stayed legitimate
until the end of the data gathering period, and likewise for
the legitimate to malicious transitions. The one exception
is os.com, a domain being leased by lexidot.com and
which transitioned from the Coinciding category to the
For sale category and back, twice during the data gathering
period. Some examples of malicious to legitimate transitions
are tumblr.com taking over timblr.com, umblr.com
and six other typosquatting domains. Some examples of
transitions in the other direction are livedoor.com losing livedooor.com and bleacherreport.com losing
bleachereport.com. For some of these legitimate to
malicious transitions, the WHOIS records clearly indicate a
change of hands, while for others the records are incomplete or
simply do not change, which could indicate that those domains
were already owned by typosquatters but were not being used
for malicious purposes initially.
H. IP Address Statistics
In the previous section we found some typosquatting domains to be very volatile, i.e., changing typosquatting categories many times during the data gathering period. To see
whether the IP address these domains resolve to also changes
regularly, we investigated the number of distinct IP addresses
and subnets associated with each typosquatting domain over
time. Fig. 9 shows the cumulative density function of the number of distinct /24 subnets per domain, for both the legitimate
domains and the malicious domains. We considered a domain
TABLE III.
IP SUBNETS AND CORRESPONDING AUTONOMOUS
SYSTEMS (AS) SERVING THE MOST MALICIOUS TYPOSQUATTING PAGES
AND DOMAINS . T OGETHER THESE NETWORKS ACCOUNT FOR 36% OF ALL
MALICIOUS PAGES AND 50% OF ALL MALICIOUS DOMAINS VISITED .
Network
208.73.210.0/23
199.59.243.96/28
82.98.86.160/27
69.43.161.128/25
AS owner
Nb visits
Nb domains
Oversee.net
Bodis
Sedo
Castle Access
259,781
209,388
187,174
140,098
2,405
1,741
1,388
1,216
60
Ad parking
Adult
Aliate abuse / Scam
Hit stealing
Other
50
40
30
20
10
0
Entertainment / Gambling
File Sharing
Blogs / Communities
Reference / Information
Marketplace / Shopping
Social Networking
Adult Content
Fig. 10. The typosquatting saturation per authoritative domain category. Adult
typosquatting domains are clearly targeting adult authoritative sites more than
other authoritative sites.
I. Registrar statistics
Based on our collected WHOIS records, we investigated
the most commonly used registrars for both legitimate and
malicious domain registrations. Ranking the registrars by their
number of malicious typosquatting domain registrations shows,
unsurprisingly, that the overall most popular registrars also
have the most malicious domain registrations. Unfortunately,
we do not know the total number of domain registrations for
each of the encountered registrars, nor have we investigated
enough domains to make statistically significant claims about
whether or not particular registrars are used more often than
others for malicious registrations.
6 http://en.wikipedia.org/wiki/Network
Solutions#Controversies
7 http://global.sitesafety.trendmicro.com/
8 http://www.mcafee.com/threat-intelligence/domain/
70
Court
UDRP
Custom
60
50
40
30
20
10
0
pl
ru com it
uk
fr org de
in
cn net br
jp
Fig. 11. The typosquatting saturation per TLD, for those TLDs with at least 5
domains in our top 500 list. The different patterns indicate the type of dispute
arbitration provided.
K. Influence of TLD
The Internet Corporation for Assigned Names and Numbers (ICANN) is responsible for coordinating the global domain name system, but has delegated the responsibility of
managing top-level domains to other commercial or nonprofit organizations, known as registry operators. This is true
for generic TLDs (.com, .org, .net, etc.) as well as for
country-code TLDs (.de, .jp, etc.). These registry operators
may also fulfill the role of registrar, or may delegate this
responsibility to other companies. A registrar must be officially
accredited by ICANN for it to directly do business with a
registry operator, while non-ICANN-accredited registrars can
only be resellers for other registrars. For the generic TLDs, all
accredited registrars have adopted the Uniform Domain-Name
Dispute-Resolution Policy (UDRP) [14]. This is a policy to
be agreed between a registrar and a registrant for a domain
name registration, giving an official domain dispute panel the
right to take down or transfer ownership of the domain in case
a third party complainant can prove the registration violates
her rights. The goal of this policy is to reduce the prevalence
of cybersquatting by saving the complainant from having to
start an expensive court procedure in order to take down the
domain.
9 According
10
to http://www.webhosting.info/registrars/top-registrars/global/
R ELATED WORK
To the best of our knowledge, our work is the first contentbased study that examines the problem of typosquatting in
time. Prior work on typosquatting almost always operated by
taking a snapshot of the typosquatting problem and characterizing that snapshot, or by limiting the longitudinal aspect
of the study to domain registration records only. Our work is
complementary to this type of prior work because it adds to the
understanding of typosquatting abuse and reveals trends that
otherwise remain hidden. In this section we review prior work
on typosquatting as well as other types of domain squatting
attacks.
Moore and Edelman performed a similar study for discovering typosquatting domains in 2010 [16] and estimated that
approximately one million typosquatting domains targeted the
top 3,264 .com sites. The authors also bring attention to the
fact that large advertising networks willingly cooperate with typosquatters by showing ads on the mistyped domains. As such,
these networks can be held equally responsible for the damage
against the authoritative domains that are being attacked. Next
to the use of ads as a monetization strategy, there have also
been documented cases of typosquatting domains used to serve
malware [9]. Nikiforakis et al. [20] showed that typosquatting
can also occur outside the confines of a browsers address bar,
in remote JavaScript inclusions. There, developers mistype the
domains of remote code providers and thus make their sites
susceptible to malicious script injections served through the
appropriate mistyped domains.
Szurdi et al. [23] recently investigated typosquatting registrations targeting .com domains that are in the long tail of
the popularity distribution. The authors present a tool named
Yet Another Typosquatting Tool (YATT), which uses passive
domain features and (optionally) active domain features such
as DNS, WHOIS and content information, to identify and
categorize typosquatting domains into categories similar to
ours. The authors use this tool to classify 4.7 million potential
typosquatting .com domains derived from the Alexa top 1 million. Their results indicate that, although the typosquatting
saturation decreases for less popular authoritative domains, it
is still at 40% near the Alexa 1 million rank and an estimated
20% of all .com domains appear to be typosquatting domains.
The study also includes a longitudinal component, tracking the
domain registrations between October 2012 and October 2013
based on daily dumps of the .com zone file. In contrast to our
study, the content of these domains is not taken into account for
the longitudinal analysis. That is, when a new domain appears
in the zone file, it is compared against the list of all potential
typosquatting domains generated from the Alexa 1 million, to
determine whether or not it is an active typosquatting domain.
The authors find, amongst other results, that typosquatting
domains of popular authoritative domains appear to change
hands much more frequently than other domains.
11
defensively registering typosquatting domains for their own domains, (2) over 75% of all possible typosquatting domains for
short popular authoritative domains are already registered, and
that typosquatters are increasingly targeting longer domains,
(3) typosquatters are varying their monetization strategy over
time, (4) some companies choose not to renew their defensive
registrations of typosquatting domains, leading these domains
back into the eager hands of typosquatters, (5) up to 50%
of all typosquatting domains can be traced back to just four
typosquatting page hosters and (6) certain top-level domains
are much less prone to typosquatting than others, due to their
price setting and local registration and arbitration policies. We
hope this paper and the corresponding dataset, which has been
made publicly available online, can serve as a new reference
for the state of the typosquatting landscape.
Homograph attacks: In domain-homograph attacks, attackers take advantage of the perceived visual similarity between
two or more letters, in order to trick the user into believing that
she is interacting with a specific authoritative website while
she is interacting with a malicious one. This confusion can be
abused to convince users to willingly submit their credentials
and other sensitive information. The main difference between
these attacks and the previously mentioned domain squatting
attacks, is that the homograph domains are usually spread-out
through spam emails and social networks, instead of relying
on user mistakes, since their construction cannot usually be
achieved through typical typing mistakes.
Gabrilovich and Gontmakher showed that characters from
non-Latin character-sets that look like Latin characters can
be substituted to confuse the user of the nature of a
given domain [10]. For instance, an attacker could register
paypal.com using the Cyrillic letter P (lower case r,
Unicode U+0440), which looks almost identical to the Latin
letter p. Today, this type of attack is significantly harder since
browser vendors revert to the punycode format of URLs [4],
whenever they think that a domain is maliciously crafted.
ACKNOWLEDGMENTS
We thank Christian Kreibich and our anonymous reviewers
for their valuable comments and suggestions that have improved the quality of this paper. This research was performed
with the financial support of the Prevention against Crime
Programme of the European Union (B-CCENTRE), and the
Research Fund KU Leuven. We acknowledge the support of
EURid, the European Registry of Internet Domain Names.
Pieter Agten holds a PhD fellowship of the Research Foundation - Flanders (FWO).
R EFERENCES
[1]
[2]
[3]
[4]
[5]
[6]
[7]
[8]
[9]
V.
C ONCLUSION
[10]
[11]
[12]
12
[13]
[14]
[15]
[16]
[17]
[18]
[19]
[20]
[21]
[22]
[23]
[24]
[25]
13
Large-scale Evaluation of Remote JavaScript Inclusions, in Proceedings of the ACM Conference on Computer and Communications Security
(CCS), 2012.
Recap, Microsoft corporation v. shah et al, http://archive.recapthelaw.
org/wawd/166997/, accessed: 2014-07-29.
C. Roth, M. Dunham, and J. Watson, Cybersquatting;
typosquatting
Facebooks $2.8 million in damages and
domain
names,
http://www.lexology.com/library/detail.aspx?g=
7088bf09-8a9e-4449-a179-d90bdfad3310.
J. Szurdi, B. Kocso, G. Cseh, J. Spring, M. Felegyhazi,
and C. Kanich, The long taile of typosquatting domain
names, in 23rd USENIX Security Symposium (USENIX Security
14).
San Diego, CA: USENIX Association, 2014, pp.
191206. [Online]. Available: https://www.usenix.org/conference/
usenixsecurity14/technical-sessions/presentation/szurdi
T. Vissers, W. Joosen, and N. Nikiforakis, Parking Sensors: Analyzing
and Detecting Parked Domains, in Proceedings of the ISOC Network
and Distributed System Security Symposium (NDSS 15), Feb 2015.
[Online]. Available: http://dx.doi.org/10.14722/ndss.2015.230053
Y.-M. Wang, D. Beck, J. Wang, C. Verbowski, and B. Daniels, Strider
typo-patrol: discovery and analysis of systematic typo-squatting, in
Proceedings of the 2nd conference on Steps to Reducing Unwanted
Traffic on the Internet - Volume 2, ser. SRUTI06. Berkeley, CA,
USA: USENIX Association, 2006, pp. 55. [Online]. Available:
http://dl.acm.org/citation.cfm?id=1251296.1251301