Seven Months’ Worth of Mistakes:
A Longitudinal Study of Typosquatting Abuse
Pieter Agten∗ , Wouter Joosen∗ , Frank Piessens∗ and Nick Nikiforakis†∗ iMinds-DistriNet, KU Leuven,{firstname}.{lastname}@cs.kuleuven.be† Department of Computer Science, Stony Brook University,

nick@cs.stonybrook.edu
Abstract—Typosquatting is the act of purposefully registeringa domain name that is a mistype of a popular domain name.
It is a concept that has been known and studied for over 15
years, yet still thoroughly practiced up until this day. Whileprevious typosquatting studies have always taken a snapshot of
the typosquatting landscape or base their longitudinal results
only on domain registration data, we present the first contentbased, longitudinal study of typosquatting. We collected data
about the typosquatting domains of the 500 most popular sites of
the Internet every day, for a period of seven months, and we use
this data to establish whether previously discovered typosquatting
trends still hold today, and to provide new results and insights
in the typosquatting landscape. In particular we reveal that,even though 95% of the popular domains we investigated are
actively targeted by typosquatters, only few trademark owners
protect themselves against this practice by proactively registering
their own typosquatting domains. We take advantage of thelongitudinal aspect of our study to show, among other results,
that typosquatting domains change hands from typosquattersto legitimate owners and vice versa, and that typosquattersvary their monetization strategy by hosting different types ofpages over time. Our study also reveals that a large fraction oftyposquatting domains can be traced back to a small group of
typosquatting page hosters and that certain top-level domains aremuch more prone to typosquatting than others.

I.

I NTRODUCTION

Domain names and the underlying domain name resolution
protocol are arguably one of the linchpin technologies that haveallowed the modern web to expand to its current dimensions.
Even though users increasingly rely on search engines tofind interesting and relevant content, domain names are asimportant as ever. This is exemplified by ICANN’s constantrollout of hundreds of new Top-Level Domains (TLDs) suchas .xxx, .guru, and .email, which were created to allow
institutes and individuals to obtain relevant domain names thatare long unavailable in the overcrowded traditional TLDs.
The importance of domain names has not gone by unnoticed by unscrupulous individuals who wish to profit at
Permission to freely reproduce all or part of this paper for noncommercial
purposes is granted provided that copies bear this notice and the full citationon the first page. Reproduction for commercial purposes is strictly prohibitedwithout the prior written consent of the Internet Society, the first-named author(for reproduction of an entire paper only), and the author’s employer if thepaper was prepared within the scope of employment.
NDSS ’15, 8-11 February 2015, San Diego, CA, USA
Copyright 2015 Internet Society, ISBN 1-891562-38-X
http://dx.doi.org/10.14722/ndss.2015.23058

the expense of others. In the nineties, some people started
registering domain names including trademarks and brandnames not belonging to them, with the hope of later sellingthem to their rightful owners at a higher price. This practice
was named domain squatting and many variations of this typeof attack have emerged over the years, with perhaps the mostpopular and exploited type being typosquatting.
In typosquatting, an attacker abuses the fact that realhuman users may mistype a URL while typing it in theirbrowser’s address bar or email client. As such, a typosquattercan register vacebook.com and capture the traffic of users
who mistype facebook.com and would otherwise receive
an error in their browsers. As a matter of fact, in May 2013,
Facebook was awarded 2.8 million dollars in damages causedby typosquatting, as well as over 100 typosquatting domainsthat were registered and monetized by typosquatters [22].
The prevalence of typosquatting has attracted the attentionof multiple researchers who attempted to map the typosquatting landscape, identify the domains that are targeted themost, and discover the preferred monetization strategies oftyposquatters [2], [8], [16], [23], [25]. What these studies
have in common, is that they either characterize a snapshot oftyposquatting activity through a single crawling effort over alimited period of time, or limit the longitudinal aspect of theirstudy to domain registration data only, without investigatingchanges in the domains’ content.
In this paper, we present the first content-based typosquatting experiment that studies the typosquatting phenomenon
longitudinally, i.e., in time. Instead of reporting on a single
snapshot of the typosquatting landscape, we performed aseven-month-long experiment in which we visited the typosquatting domains targeting the 500 most popular sites of
the Internet every day. Through the collection of more than
900 GB of typosquatting data, our study allows us not only tomeasure typosquatting at a large scale but also to investigate
the changes of typosquatting domains over time, allowing us
to answer questions that could not be answered with a single
snapshot of typosquatting activity.
Among other results, we find that, even though 95% of
the most popular domains on the Internet are targeted bytyposquatters, most of them do not use defensive registrations
as a means of protecting their identity and their clients. We alsofind that a large fraction of all possible typosquatting domains
for short popular authoritative domains is already registered,and that typosquatters are hence increasingly targeting longer

While one can likely come up with more ways of including
typos in a domain name, e.g., a wrong domain TLD, in thiswork, we limit ourselves to the typosquatting domains thatcan be generated following the aforementioned typo models.
We also limit ourselves to domains resulting from a single
application of one of these models, since those are more likely
to be typed by a user than domains containing multiple typos.

domains. Making use of the longitudinal aspect of our study,
we discover that typosquatters are actively switching between
monetization strategies for the domains that they own, andare also on the look-out for expiring registrations of populardomain names. We also show that 50% of all typosquatting
domains can be traced back to just four typosquatting page
hosters. Finally, on the policy-side, we observe that differencesin domain price setting and the availability of out-of-court
domain dispute resolution procedures between different TLDs,
have a significant effect on the prevalence of typosquatting.

B. Data Gathering
To gather the data required for our longitudinal study, we
set up two automated crawlers, which where supplied with
the Alexa top 500 domains of April 1, 2013 as input. The
first crawler generates the typosquatting domains for eachauthoritative domain in the input, according to the aforementioned models. For each authoritative and generated domain,
the crawler first determines whether the domain resolves to an
IP address. If so, the crawler visits the web page hosted on thedomain using PhantomJS1 , a headless JavaScript-enabled webbrowser. After loading the web page, the crawler waits for 10
seconds, allowing the page to load dynamic content or perform
a redirect. Finally, the crawler saves the IP address, final URL,
HTML body and a screenshot of the page to disk. The crawler
was configured to process the entire list of domains daily, for aperiod of 7 months starting at April 1, 2013 and running until
October 31, 2013. The crawl was duplicated onto a second
machine to provide redundancy in case of system failure. In
order to prevent excessive resource usage and to minimize
the chance of our crawlers being blocked by typosquatting
domains, duplicate typosquatting domains were filtered out
and the rate at which the crawlers visit domains was set to theminimum value that still allows a crawl to finish within a small
margin of 24 hours. In total, 28,179 potential typosquatting
domains were generated, out of which 17,172 resolved to an
IP address at least once during our study.

Our main contributions are:•

We report on the first content-based longitudinal studyof typosquatting abuse, consisting of over 900 GB ofdata gathered over a period of seven months.

•

We verify whether previously discovered typosquatting trends still hold today.

•

We provide new results and insights in the typosquatting landscape, based on both the static and longitudinal aspects of our data.

•

We show that the adoption of strict policies andeasy dispute-resolution procedures from registries, candecrease typosquatting abuse.

The rest of this paper is structured as follows. In Section II, we provide background information on typosquatting
in general and on the way our data gathering experiment
was set up. Section III describes the main results found by
our experiment. Section IV describes related work and finally
Section V concludes.
II.

BACKGROUND

A. Typosquatting Models

The second crawler was configured to perform a WHOIS
lookup for every domain ever successfully resolved by the
HTTP crawler. The WHOIS responses (if any) were parsed
using Ruby Whois2 and then saved to disk. The crawler was
configured to process all domains once per week, over the sametime period as the HTTP crawler. The slower one-week crawlinterval was needed to respect the acceptable use policies of
the queried WHOIS servers.

The most frequently occurring domain name typos arethose that have a Damerau-Levenshtein distance of one froma popular domain name [3], i.e., domain names resulting
from a single character insertion, deletion, substitution or
adjacent character permutation from a popular domain. Whenthe inserted or substituted character is adjacent to the original
character on a QWERTY keyboard, we say the typosquatting domain also has a “fat-finger distance” of one [16]. In
2006, Wang et al. categorized typosquatting domains into fivedifferent categories [25]. Based on those categories and assuming the authoritative domain example.com and intended
URL www.example.com, we consider the following fivetyposquatting models for our study:
1)
2)
3)
4)

5)

One irregularity that occurred during our data gathering
period is that the crawl rate of our crawlers had to be increased
during the week of August 21, to accommodate for a planned
power interruption of our crawling machines on August 27
and 28. The possible effects of this irregularity are discussed
in Section III-B.

Missing-dot typos: The dot following “www” isforgotten, e.g., wwwexample.com
Character-omission typos: One character is omitted,
e.g., www.exmple.com
Character-permutation typos: Consecutive characters are swapped, e.g., www.examlpe.com
Character-substitution typos: Characters are replaced by their adjacent ones, given a specific keyboard layout, e.g., www.ezample.com where “x”
was replaced by the QWERTY-adjacent “z”.
Character-duplication typos: Characters are mistakenly typed twice, e.g., www.exaample.com

C. Analysis
Our crawlers collected over 900 GB worth of data during
the data gathering period, consisting of 3,389,137 web pages
and 424,278 distinct WHOIS records. In order to analyze
this data, we classified the collected pages into the categories
listed in Table I. The third column of this table indicates foreach category whether we consider it a legitimate, maliciousor undetermined use of a domain name. Although most of
1 http://phantomjs.org/
2 http://ruby-whois.org/

2which a website owner (the advertiser) pays a commission to athird party (the affiliate) for sending traffic to her website. For
instance, amazon.com pays a commission for every purchasemade by visitors coming from websites participating in theiraffiliate program. To identify what traffic comes from which
affiliate, each affiliate is assigned a unique identifier that sheshould specify in the URLs toward which she forwards her
visitors. Sometimes an intermediate company sits in between
the advertiser and the affiliate to handle the technical issuesof organizing an affiliate program and to make it easier foradvertisers and affiliates to find each other. Most affiliate
programs have strict conditions that limit the ways in which
affiliates are allowed to bring traffic to the advertiser’s website.
Banners and hyperlinks to the advertiser’s site are allowed, but
automatic forwarding typically is not. For instance, Amazon
explicitly disallows automatic forwarding.

the malicious categories are actually in a legal gray area, wemark them as malicious because these practices are set up to
deceptively extract profit from users’ mistypings.
As a first step towards classifying the collected pages
into the selected categories, we tried to automatically divide
the pages into clusters. Since some types of typosquatting
pages (such as generic ad parking pages) are likely to target
many different authoritative domains, we decided to cluster
the pages based on visual appearance rather than domainspecific properties such as the page’s domain name or thecorresponding authoritative domain. To measure the visualappearance of a page, we used the concatenation of a perceptual hash of the page’s screenshot and a locality-sensitive
hash of its HTML body. The perceptual hash of an image isa fixed-length bit vector that represents a fingerprint of thatimage. Unlike cryptographic hashes, which give a drasticallydifferent output for small changes in the input, perceptual
hash functions are designed to produce similar outputs for
similar inputs. A locality-sensitive hash is based on the same
principle, but works on textual data instead of multimedia
files. These hashes allow us to programmatically compare thescreenshots and HTML bodies of the collected pages, in orderto group them into clusters of similar pages. The concrete
perceptual and locality-sensitive hash algorithms we used are
the aHash3 and the Nilsimsa4 algorithm respectively, whichwere selected based on an evaluation of their performance ona small subset of the dataset that was clustered manually. Using
these hash functions and a custom clustering algorithm basedon fastcluster [17], the 3,389,137 collected web pages wereautomatically grouped into 8,102 clusters.

An example of affiliate abuse by typosquatting that is
active at the time of this writing, is the following: users who
mistype match.com as ma5ch.com (“t” substituted by the
QWERTY-adjacent “5”) are eventually brought back to thematch.com domain, but the typosquatting page appends anaffiliate identifier to the URL when it redirects the user’s
browser from the typosquatting domain to the authoritative
one. As such, the owners of the authoritative domain will now
have to pay an affiliate commission to the typosquatter, for avisit that should have been theirs in the first place.
Identifying affiliate abuse is not always easy. In particular,a naive analysis cannot differentiate affiliate abuse from socalled defensive registrations, which are typosquatting domains
proactively registered by an authoritative domain owner, toprevent abuse from typosquatters. Both types of domains
forward their visitors to the authoritative domain, typicallyadding an identifying parameter to the forwarding URL. In
the case of affiliate abuse, this parameter is used to identify
the affiliate, while in the case of defensive registrations it istypically used to identify the forwarding domain (for traffic
analysis purposes). Because of this similarity, we did not
attempt to automatically identify affiliate abuse, relying on our
second-phase manual analysis for this instead. For this manual
analysis, we took into account several factors to identify
affiliate abuse, including (1) the names of parameters added
to the forwarding URL, (2) the values of these parameters,(3) whether the authoritative site advertises the fact that it
has an affiliate program, and (4) the WHOIS records of theauthoritative and typosquatting domains. We did not attempt
to distinguish between typosquatting pages abusing an affiliate
program of their own authoritative domain or an affiliate
program of other unrelated domains, e.g., a typosquatting
domain of target.com redirecting the user to the affiliate
program of amazon.com.

After this initial clustering, we spent approximately two
and a half man-months performing an extensive manual analysis of the data. The goals of this manual analysis were
twofold: i) to improve the automatic visual clustering results,
and ii) to categorize the clusters into the categories of Table I.
In order to assign the appropriate category to each page,clusters of visually similar pages were, in many cases, split
up into smaller clusters. For instance, the cluster of pages
looking like amazon.com was split up into sub-clusters for
authoritative pages, affiliate abuse pages and ad parking pages.
To facilitate the manual analysis, we developed a custom web
application that presents all of the collected data, i.e., thescreenshots, WHOIS records, IP addresses and final URLs
of the visited web pages, in a structured way. Ultimately,
40% of all clusters were classified, representing 95% of allcollected pages. Because of this second-phase manual analysis,
we have high confidence in the quality and accuracy of ourdata. Our dataset has been made available for download athttps://distrinet.cs.kuleuven.be/software/typos15/.
D. Types of Abuse
In this section we briefly describe the non-self-explanatory
categories listed in Table I.

2) Scam: A scam page is a page that tries to trick users
into performing an action that is undesirable for the user
and profitable for the attacker. Two popular types of scams
are “surveys” and malicious advertisements (malvertising). In
surveys, users are asked to perform a series of steps in returnfor some reward, for example a $100 coupon for a big box
store. The steps almost always involve users entering theiremail address, name, phone number and potentially physicaladdress. These details can then be used to subscribe users to1) Affiliate abuse: We consider a page to be performing
affiliate abuse when it redirects its visitors to a legitimate
website, taking advantage of an affiliate program offered bythat legitimate site. Affiliate programs are arrangements in
3 https://github.com/JohannesBuchner/imagehash
4 http://ixazon.dynip.com/∼cmeclax/nilsimsa.html

3

TABLE I.

T HE COLLECTED TYPOSQUATTING PAGES WERE CLASSIFIED INTO CATEGORIES , BASED ON THE MOST LIKELY INTENT OF THE PAGE . T HE
THIRD COLUMN INDICATES THE CATEGORY TYPE : L STANDS FOR LEGITIMATE , M STANDS FOR MALICIOUS AND U STANDS FOR UNDETERMINED .

Category

Description

T

Authoritative
Coinciding
Protected
Ad parking
Adult content
Affiliate abuse
For sale
Hit stealing
Scam
No content
Server error
Crawl error
Other

Pages redirecting to or displaying the authoritative domain without any abuse
Pages containing legitimate content that happen to reside on a typosquatting variant of an authoritative domain
Pages notifying the user that she made a typo and/or link to the authoritative domain
Pages that have no content other than showing advertisements
Pages showing adult/pornographic content
Pages taking advantage of an affiliate program offered by another domain (see Section II-D1)
Pages that have no content other than being advertised as for sale
Pages redirecting to a legitimate domain without abusing an affiliate program
Pages persuading the user to enter personal information or to download malware (see Section II-D2)
Pages that have no content (e.g., blank pages or pages under construction)
Pages displaying an error, which was caused by a server-side problem
Pages for which the crawler failed or that explicitly block the crawler’s IP address
Unclassified pages and pages that do not fall into any of the above categories

L
L
L
M
M
M
M
M
M
U
U
U
U

authoritative domain. Many registrars provide a service toautomatically register a wide range of possible cybersquatting
domain names when a trademark owner wants to registera domain. Nevertheless, our data shows that only 156 of
the authoritative domains in our list have defensive domain
registrations, meaning that 344 domains (representing 68.8%
of the 500 most popular sites of the Internet) have no defensive
registrations whatsoever. Thus, anyone who makes a typo forthese domains and does not receive an error, is sure to landon a malicious typosquatting page.
The top 3 of authoritative domains with the most defensive registrations consists of huffingtonpost.com with57 defensive domains, americanexpress.com with 42
domains and bloomberg.com with 39 domains. The top 3
of authoritative domains with the most malicious typosquatting domains are adultfriendfinder.com with 132
typosquatting domains, constantcontact.com with 103
typosquatting domains and odnoklassniki.ru with 97
such domains. Alarmingly, out of the three banks in our
top 500 list (bankofamerica.com, hdfcbank.com andicicibank.com), only bankofamerica.com has defensive registrations. This means that if a user enters a typo
for the domain of one of the two other banks, she could
easily land on a phishing page, thinking she entered theproper domain name of her bank. Although we did notencounter any phishing pages for these banks during ourstudy, our data shows hdfcbank.com had 42 active malicious typosquatting domains, icicibank.com had 43, andbankofamerica.com had 46. Any of these domains could
start hosting phishing pages at any time or redirect users to
the websites of competing financial institutes.

Fig. 1. A scam page trying to trick users mistyping youtube.com into
downloading malware.

spam lists, expensive mobile services, and even potentially soldto larger data aggregators.
In malvertising, the scam page is trying to convince theuser to willingly download and execute a malicious program.
Fig. 1 shows the ad we got when purposefully mistyping
youtube.com as outube.com. If the user downloads andinstalls the purported software update, she will be infected withmalware (11/51 virus engines at virustotal.com identified the
downloaded executable as malicious).
III.

R ESULTS

A. Malicious vs. Defensive Registrations
Our data indicates that typosquatting is still very prevalent
for the list of authoritative domains we considered. Out of these500 domains, 477 have at least one malicious typosquatting
domain. We considered a domain to be malicious when it
is classified as such for at least 7 days during the data
gathering period. These numbers indicates that on the attackside, typosquatters have no trouble registering and exploiting
typosquatting domains, despite long-standing anticybersquatting legislation [1].

It is surprising to see that, in a time where companies
are estimated to spend 7% of their information technology
budgets on security, and global cyber crime costs are estimatedbetween $300 billion and $1 trillion [15], many companies do
not bother to make any defensive registrations at all for their
domains. In particular, one would expect the financial sector
to take a leading role in protecting their reputation and theircustomers. It seems these companies are either not aware of
the problem, or simply do not care about it. The fact that large
Internet companies such as Microsoft [21] and Facebook [22]are successfully contending with cybersquatters through defen-

On the defense side, trademark owners can protect themselves against typosquatting by proactively making defensive
typosquatting domain registrations whenever they register an4

sive domain registrations and legal actions, demonstrates thatthe problem is real and should not be ignored.

Number of domains

14000

B. Daily Typosquatting Domain Count
Taking the Alexa top 500 domains as input, our HTTP
crawler generated 28,179 potential typosquatting domains,based on the models discussed in Section II-A. From those potential typosquatting domains, 17,172 domains (61%) at least
once during our data gathering period resolved to an IP addressthat was hosting a web page. From those active typosquatting
domains, 13,526 domains (79%) were hosting malicious content for at least one day. Fig. 2 illustrates the daily growthin the number of discovered domains. The crossed-out line
shows the total number of malicious typosquatting domains
discovered up until a certain date. Since this is a cumulative
measure, this line is strictly increasing. The figure shows anincrease from about 11,000 domains at the start of the period
to 13,526 domains at the end, indicating that typosquatters arecontinuously acquiring new typosquatting domains.

Total malicious typosquatting domains
Active malicious typosquatting domains

13000
12000
11000
10000
9000
01/04 01/05

01/06

01/07

01/08

01/09 01/10

01/11

Fig. 2. The daily domain count shows an average of 10,500 active malicious
typosquatting domains per day and a steady increase in the total number of
discovered malicious typosquatting domains over time.

Number of domains

14000

The solid line in the same figure shows the daily number ofactive typosquatting domains serving malicious content. Thisline does not follow the monotonic increase of the crossed-out
line, indicating that typosquatters are not only registering new
domains, but are also getting rid of domains at approximately
the same rate. On average, there are 10,510 active malicious
typosquatting domains per day, which amounts to 21 suchdomains per authoritative domain. Apart from three significant dips, which are discussed below, the number of active
malicious typosquatting domains remains fairly constant over
time.

12000
10000
8000
6000
4000
2000
0
01/04 01/05 01/06 01/07 01/08
Ad parking
Aﬀ. abuse / Scam
No content
Hit stealing

01/09 01/10
Error
Other

01/11

Fig. 3. Apart from the three dips discussed in Section III-B, the category
distribution remains relatively constant over time.

As can be seen from the figure, the first dip in the numberof active malicious typosquatting domains took place from
June 4 to 6. Our data indicates this dip can be attributed to asingle large cluster of ad parking pages that contained significantly fewer domains during these days. This cluster, whichis the single largest cluster of our data set, has an average of
2,136 domains per day, but contained only 1,049 domains per
day during these three days. Furthermore, 97% of the domainsthat dropped out during this period resolved to a single
subnet in the days before, namely 208.73.210.0/23, an IP
address block in an autonomous system owned by Oversee.net.
These results indicate that a single large ad parking hoster,
related to Oversee.net, for some reason blocked our crawlers
or was having network connectivity problems.

temporarily returning blank pages or showing errors, although
we could not find any specific reason for these servers to block
our crawlers during these days.
C. Category Distribution
Fig. 3 shows how the collected typosquatting pages are
distributed over the categories listed in Table I. To improvereadability, some related or very small categories have beengrouped together and the legitimate pages have been excluded
from the graph. We can see that, apart from the dips discussed above, the distribution stays relatively constant overtime. Table II shows the overall distribution of the visited
typosquatting pages over all identified categories. Clearly, thead parking category is by far the largest, confirming the resultsof Moore and Edelman [16]. The second largest category
consists of the pages showing no content, including completely

The second dip took place from August 21 to 25 and ispreceded by a more subtle reduction in the number of active
typosquatting domains in the weeks before. Our data showsthat 1,675 domains that were previously hosting ads started
serving blank pages or showed an error during this period (seealso Fig. 3). More than 90% of those domains were parked
with Sedo.5 The dip coincides with the period during which
our crawl rate was increased (see Section II-C), which leads
us to believe that some of Sedo’s ad parking servers blocked
our crawlers due to the increased traffic.

TABLE II.

T HE DISTRIBUTION OF TYPOSQUATTING PAGES OVER ALL
IDENTIFIED CATEGORIES . T HE AUTHORITATIVE DOMAIN VISITS ARE
EXCLUDED FROM THESE NUMBERS .
Category
Ad parking
No content
Affiliate abuse
Authoritative
Hit stealing
Coinciding
Server error

On October 18 and 20, the number of active malicious
typosquatting domains again drops by a significant amount.
Our data indicates this dip is again due to Sedo servers
5 http://www.sedo.com/

550.55%
11.62%
6.89%
5.37%
4.90%
4.88%
3.03%

Category
Scam
Adult
For saleCrawl error
Other
Protected
Unclassified

2.40%
1.90%
1.56%
0.99%
0.30%
0.29%
5.20%

Typosquatting saturation (%)

blank or black pages and pages that label themselves as underconstruction. By manual analysis, we discovered that some ofthe domains showing blank and black pages did show content
when visited through a foreign proxy server, indicating thatsome typosquatters were using IP blacklists or geolocation
information to block our crawlers.

Malicious
Defensive

60
50
40
30
20
10
0

ar

Ch

ar

Ch

ar

si

ar

Ch

Ch

is

M

su
t
bs

rm

pe

m

t

do

pl

du

ng

om

The affiliate abuse category is ranked third. During ourmanual analysis, we discovered that many of the pages in thiscategory are using third-party services to hide the referring
URL when abusing an affiliate program. For instance the typosquatting domain hostgatkr.com forwards its visitors to
tracking.warmmedia.com (with a parameter indicatingwhere to redirect to further on), which then redirects the visitor
to a URL within the hostgator.com domain, specifying anaffiliate id parameter. Because of the intermediate redirection,
the exploited site hostgator.com sees visitors comingfrom warmmedia.com instead of hostgatkr.com. This
makes it much harder for HostGator to discover that they
are paying a commission for traffic that should have been
theirs in the first place. Other commonly used redirection
services we discovered are trafficinterface.com andworld-redirect.com.

70

Fig. 4. The typosquatting saturation per typosquatting model. Although thesubstitution model has the most domains in absolute numbers, it is the least
popular taking into account the number of domains generated by each model.

number of registered domains for each of the five models
described in Section II-A. Our data indicates there are 6,399
malicious and 376 defensive registrations for domains generated by the character substitution model, making it the mostpopular model in absolute numbers. This is to be expected
however, because the character substitution model generates
much more typosquatting domains for a given authoritative
domain than any other model. Conversely, the missing dot
model only generates a single possible typosquatting domain
per authoritative domain. To accurately compare the popularityof the different typosquatting models, we should hence look at
the active fraction of all possible typosquatting domains, pertyposquatting model. That is, out of all typosquatting domains
generated according to some model (starting from our list of
authoritative domains), we look at how many of them are active(i.e., resolve to a web page). We call this relative measure
the typosquatting saturation per typosquatting model. Fig. 4
shows the typosquatting saturation for each of the five models
we consider, differentiating between defensive and malicious
registrations. We can see that, by this measure, the character
substitution model is actually the least popular model, i.e., outof all possible typosquatting domains generated by this model,
less than 40% are in use. The figure shows that the missing
dot model is the most popular model, for defensive as well as
for malicious registrations. Our data indicates no significant
change in the popularity of the different models over time.

Hit stealing is ranked fifth in Table II but is the thirdlargest malicious category. We discovered two distinct typesof domains in this category. The first type consists of domains owned by a competitor of the authoritative site thatis being typosquatted. These domains typically just forward
their visitors to the competitor’s site, effectively stealing
the traffic of the authoritative domain. While we saw thisbehavior mostly with adult sites, some non-adult sites arestealing hits from their competitors as well. For instance, theRussian search site tochki.ru has typosquatting sites registered for google.com.ua, google.ru, rambler.ru
and yandex.ru. The other type of hit stealing domains arethose owned by Internet marketing companies trying to draw
traffic to the sites of their customers. These domains typically forward their visitors to unrelated pages, often changing
the destination domain at regular time intervals or even on
every visit. For instance, over a dozen Czech typosquatting
domains of google.cz and seznam.cz were forwarding
their visitors to a different legitimate Czech domain on every
visit. Similarities in the way the forwarding is implemented onthese different typosquatting domains and in the parametersspecified in the destination URL, lead us to believe that allof these domains are owned by a single Internet marketingcompany that is using them to draw traffic to its customers.
This is of course a questionable way of increasing the traffic
to their customers’ websites, since the typosquatting domains
used for this purpose are typically unrelated to the various
landing pages, making it unlikely that a redirected visitor will
stay on the landing domain. As such, while the landing page
will likely receive hundreds or thousands of extra visitors, it
is doubtful that these visitors will be of value. One could
argue that these companies are providing “typosquatting-asa-service” rather than proper Internet marketing services.

Note that if we would rank the five models based on
their corresponding typosquatting saturation, we get the sameranking whether we consider malicious or defensive registrations. This suggests that attackers and defenders have a similar
perception of what typosquatting domains are worthwhile toregister.
E. Influence of Domain Name Length
Since four of the five typosquatting models we consider
can be applied for each character in a domain name, thenumber of possible typosquatting domains for a given authoritative domain increases linearly with the length of theauthoritative domain. Previous work published by Banerjee
et al. [2] indicated that the active number of typosquatting
domains for a given authoritative domain does not follow thisrelation: shorter domains were targeted much more frequently
than longer domains. Our data shows that this is no longer the

D. Typosquatting Models
To investigate to what degree typosquatters and legitimate
domain owners are aware of the different models that canbe used to generate typosquatting domains, we calculated the6Typosquatting saturation (%)

Typosquatting saturation (%)

100

All models
No char subst

80
60
40
20
0

2

3

4

5

6

7

8

9 10 11 12 13 14 14+

Authoritative domain name length

100
80
60
40
20
0

1-100

101-200

201-300

301-400

401-500

Alexa rank

Fig. 5. Domains with short names suffer more from typosquatting, but thiseffect is not nearly as outspoken as in the ’08 results of Banerjee et al. [2].

Fig. 6. Our data shows no significant correlation between Alexa rank andsaturation.

case, as illustrated by Fig. 5. The solid black bars in this figure
show the average typosquatting saturation per authoritative
domain name length when taking all five typosquatting models
into account. That is, the Y-axis shows the percentage ofall possible typosquatting domains of authoritative domainsof a certain length that are active (i.e., resolve to an IP
address hosting a website). As mentioned in Section III-D,
the typosquatting saturation is an averaging over time and in
this case takes into account the fact that longer authoritative
domains have more possible typosquatting domains. Although
the solid bars show a decrease in typosquatting saturation as
the authoritative domain length increases, this decrease is notnearly as outspoken as in the results of Banerjee et al. in2008 [2], where the typosquatting saturation quickly drops tounder 20% for domains longer than 5 characters.

the saturation within each rank bin varies widely and showsno significant correlation between rank and saturation. This
contradicts the ’08 results of Banerjee et al. [2], which indicated that the percentage of active typosquatting domains
for a given authoritative domain reduces significantly withdecreasing popularity, reaching only about 20% for the domainranking 500 in their list of authoritative domains. Our results
hence indicate typosquatters have started focusing on lower
ranking domains in the past six years, in addition to the
top ranking domains. These results are consistent with therecent findings of Szurdi et al. [23], who investigated thetyposquatting activity for all .com domains in the Alexa
top 1 million. Their study indicates that, although there isa positive correlation between typosquatting saturation andauthoritative domain popularity, the typosquatting saturationis still at 40% near the Alexa 1 million rank.

Furthermore, since the number of possible typosquatting
domains following the character substitution model rises very
quickly as the domain length increases, and the previous
section has shown that this is the least popular typosquatting model, we can automatically expect the typosquatting
saturation to drop with increasing domain length. To remove
this bias, the crossed-out bars in Fig. 5 discard the character
substitution model. Here we can see even more clearly that
there is no correlation between typosquatting saturation andauthoritative domain length for the domains we investigated.

To further investigate the influence of authoritative domain
popularity on typosquatting activity, we investigated whether
there is a correlation between the change in Alexa rank of an
authoritative domain over our data gathering period, and thechange in number of active malicious typosquatting domainsof that authoritative domain. We did this by comparing theauthoritative domain ranks and the number of active malicious
typosquatting domains during the first week our data gathering
period with the same figures during the last week of data
gathering period, but we found no significant correlation.

These results indicate that typosquatters have started targeting longer authoritative domains in the past six years. The most
likely reason for this is that most short typosquatting domains
were already in use: the figure illustrates that the averagetyposquatting saturation for domain names up to 8 charactersis over 75%. A large fraction of the possible typosquatting
domains of relatively short, popular websites is hence alreadyregistered.

G. Typosquatting Domain Volatility
One of the main objectives of our longitudinal study isto evaluate the volatility of the field of typosquatting. In
particular, we would like to see (1) whether domains arechanging hands from typosquatters to legitimate owners and(2) whether typosquatters vary the type of content they hoston their domains. For this, we look at the number of categorytransitions per domain. To avoid overestimating the number oftransitions, we assume that the content hosted on a domain
does not change when we see a transition from a legitimate
or malicious category to an undetermined category. That is,
suppose a domain is in a legitimate or malicious category C
at date x and is in an undetermined category at date x+1, thenwe still consider the domain to be in category C at date x + 1.
We used this methodology to generate the graph in Fig. 7,
which hence gives a lower bound on the number of categorytransitions per domain over time.

F. Influence of Alexa Rank
Since typosquatters are trying to get as many page hits as
possible, more popular authoritative domains are presumably
targeted more often than less popular domains. Fig. 6 showsa box-and-whisker plot indicating the typosquatting saturation
per Alexa rank. The ends of the whiskers show the minimum
and maximum typosquatting saturation, the box shows theupper and lower quartiles and the line within the box shows
the median typosquatting saturation. The plot indicates that
7

40
30
20
10
0

Probability

50

6000
5500
5000
4500
4000
3500
3000
2500
2000
1500
1000
500
0

Malicious category transitions
Malicous to legit
Legit to malicious

Malicious category transitions

Legit-malicious transitions

60

1
0.9
0.8
0.7
0.6
0.5
0.4
0.3

Legitimate domains
Malicious domains
1

2

3

4

5

6

7

8

9

10 11 12 13 14

Number of distinct /24 subnets per domain

3
-4
42 1
-4
40 9
-3
38 7
-3
36 5
-3
34 3
-3
32 1
-3
30 9
-2
28 7
-2
26 5
-2
24 3
-2
22 1
-2
20 9
-1
18 7
-1
16 5
-1

14

Fig. 9. Cumulative distribution function of the number of /24 subnets per
domain. Malicious domains are more likely to resolve to multiple subnets overtime than legitimate domains.

Week of 2013

Fig. 7. The number of category transitions per domain. The two bottomlines use the left Y-scale, the top line uses the right Y-scale. Domains are
moving from typosquatters to legitimate owners and vice versa, and are oftenchanging category while being malicious.

abuse” category. With an average of 1,239 transitions per
week, we can see that these kinds of transitions occur much
more frequently than legit-malicious transitions. If we average
the total number of category transitions over the number of
discovered typosquatting domains, we get a value of 2.84
transitions per domain over the seven month data gathering
period. This means that, on average, a typosquatting domain
serves pages from the same category for about 75 days ina row. However, in practice most domains did not change
category at all during the data gathering period, while somechanged very often. The bar chart in Fig. 8 shows the frequency
distribution of the number of malicious category transitions per
domain. The data indicates that 8,521 domains, representing
65% of all malicious typosquatting domains, stayed in thesame category for the entire duration of the study, and 95%
of all malicious typosquatting domains made less than 20
category changes. Nevertheless, there are some domains thatswitch malicious categories up to 79 times.

Number of domains

10000
1000
100
10
1
0

10

20

30

40

50

60

70

80

Number of malicious category transitions per domain

Fig. 8. Frequency distribution of the number of malicious category transitions
per domain. Note that the Y-axis has a logarithmic scale.

By manual inspection, we saw some typosquatting domains
redirect to a different landing page on a regular basis, sometimes even on every visit. We posit that the domains operatingin this fashion can be subdivided into two types. The first typeof domains shows different categories of landing pages, often
switching between ad parking, affiliate abuse and scamming
pages. Typosquatters most likely use this scheme to diversify
their monetization strategy, possibly even switching to the mostprofitable strategy dynamically. An example of a typosquatting
domain of this type is yuotube.com, a domain that, at thetime of writing, switches between pages classified under thead parking, affiliate abuse and scam categories on every visit.
The other type of domains shows many different pages overtime, but all within the general hit stealing category. These
domains are owned by the rogue Internet marketing company
for drawing traffic to the sites of its customers, as discussed
in Section III-C.

The two bottom lines of this figure refer to the lefthand Y-scale and show the total number of malicious tolegitimate or legitimate to malicious transitions. During ourstudy, we saw an average of about 3 malicious-to-legitimate,
and about 2 legitimate-to-malicious transitions per week.
These numbers indicate legitimate owners are taking overdomains from typosquatters and vice versa, albeit not in great
numbers. With the exception of one domain, all domainsthat moved from malicious to legitimate stayed legitimate
until the end of the data gathering period, and likewise forthe legitimate to malicious transitions. The one exception
is os.com, a domain being leased by lexidot.com andwhich transitioned from the “Coinciding” category to the“For sale” category and back, twice during the data gathering
period. Some examples of malicious to legitimate transitions
are tumblr.com taking over timblr.com, umblr.com
and six other typosquatting domains. Some examples oftransitions in the other direction are livedoor.com losing livedooor.com and bleacherreport.com losing
bleachereport.com. For some of these legitimate to
malicious transitions, the WHOIS records clearly indicate achange of hands, while for others the records are incomplete orsimply do not change, which could indicate that those domains
were already owned by typosquatters but were not being used
for malicious purposes initially.

H. IP Address Statistics
In the previous section we found some typosquatting domains to be very volatile, i.e., changing typosquatting categories many times during the data gathering period. To see
whether the IP address these domains resolve to also changes
regularly, we investigated the number of distinct IP addresses
and subnets associated with each typosquatting domain overtime. Fig. 9 shows the cumulative density function of the number of distinct /24 subnets per domain, for both the legitimate
domains and the malicious domains. We considered a domain

The upper line of Fig. 7 uses the right-hand Y-scale andshows the number of malicious category transitions, e.g., atransition from the “Ad Parking” category to the “Affiliate8Typosquatting saturation (%)

TABLE III.
IP SUBNETS AND CORRESPONDING AUTONOMOUS
SYSTEMS (AS) SERVING THE MOST MALICIOUS TYPOSQUATTING PAGESAND DOMAINS . T OGETHER THESE NETWORKS ACCOUNT FOR 36% OF ALL
MALICIOUS PAGES AND 50% OF ALL MALICIOUS DOMAINS VISITED .
Network
208.73.210.0/23
199.59.243.96/28
82.98.86.160/27
69.43.161.128/25

AS ownerNb visits

Nb domains

Oversee.net
Bodis
Sedo
Castle Access

259,781
209,388
187,174
140,098

2,405
1,741
1,388
1,216

60

Ad parking
Adult
Aﬃliate abuse / Scam
Hit stealing
Other

50
40
30
20
10
0

Web Advertising / SEO

Search Engine / Portal

Forum / Chat / Messaging

Web / Image / Code Hosting

Entertainment / Gambling

File Sharing

Corporate / Product Website

Blogs / Communities

News / Media / Tech Reviews

Reference / Information

Marketplace / Shopping

Streaming Media / eBooks

Social Networking

Adult Content

to be legitimate when it is classified as such for at least 90% of
the data gathering period, and we again considered a domain
to be malicious when it is classified as malicious for at least
7 days. We only take into account the 24 most significant bitsof an IP address to group together addresses that are close toeach other, for instance belonging to servers in the same data
center. Changing the subnet mask by a couple of bits has no
significant influence on the graph. We can see from the graphthat malicious domains are much more likely to resolve tomore than one subnet over time than legitimate domains. For
up to 90% of all domains, malicious domains resolve to more
distinct subnets over time than legitimate domains.

Fig. 10. The typosquatting saturation per authoritative domain category. Adult
typosquatting domains are clearly targeting adult authoritative sites more thanother authoritative sites.

Conversely, we can also look at the number of malicious
typosquatting domains per IP subnet. The 13,526 malicious
typosquatting domains discovered during our study resolve
to only 2,377 distinct IP addresses, which means that on
average each of them hosts 5.7 typosquatting domains. In
practice, however, a much smaller range of IP addresses hostsa very large fraction of the typosquatting pages: the four
subnets shown in Table III together host 36% of all malicious
typosquatting pages and 50% of all malicious typosquatting
domains visited during the study. The table also shows theowner of the autonomous system corresponding to each network. Except for Castle Access, which operates enterprise data
centers, each of these companies is in the domain parking
business.

than average reputation6 , nor that it positions itself as a brandprotection specialist. We suspect many legitimate domains areregistered through this company because of its historic role,
first as registry for the .com, .org and .net zones and lateras the sole domain registrar for these TLDs, until ’98. Our data
indeed indicates that their legitimate domains are mostly highprofile domains with a length of 2 to 5 characters, registeredin the 1990’s.
We posit that the reason for these results is that the total
set of typosquatting domains for any given authoritative site is
spread among many typosquatters, a claim which is supported
by our WHOIS data. Since each typosquatter can opt fora different registrar, there is a dilution of malicious activity
over the most popular registrars. On the other hand, whena legitimate company uses a brand protection service, alldefensive domain registrations are likely to be done throughthe same registrar. As such, the legitimate registrations willtend to cluster, while the malicious registrations will tend to
get diffused.

I. Registrar statistics
Based on our collected WHOIS records, we investigatedthe most commonly used registrars for both legitimate andmalicious domain registrations. Ranking the registrars by their
number of malicious typosquatting domain registrations shows,unsurprisingly, that the overall most popular registrars also
have the most malicious domain registrations. Unfortunately,
we do not know the total number of domain registrations foreach of the encountered registrars, nor have we investigatedenough domains to make statistically significant claims about
whether or not particular registrars are used more often thanothers for malicious registrations.

J. Influence of Authoritative Domain TypeTo see whether typosquatters indiscriminately target all
popular domains, or rather target certain kinds of authoritative domains more often than others, we classified ourlist of authoritative domains into content-based categories.
This classification was done manually, with the assistanceof Trend Micro’s Site Safety Center7 and McAfee’s ThreatIntelligence8 domain categorization services. Fig. 10 shows thetyposquatting saturation for these authoritative categories andalso illustrates the relative contribution of the most important
malicious typosquatting categories to the saturation. Since
our data indicates no significant change of the typosquatting

Nonetheless, our data does show that some registrars havea significantly higher ratio of legitimate to malicious registrations than others. These are mostly reputable registrars that
explicitly market themselves as brand protection or corporate
domain portfolio management companies, such as Safenames
and Corporation Service Company (CSC). However, we also
found the company Network Solutions to have a high ratioof legitimate to malicious domains in our study, even though
we could not find any evidence that this company has a better

6 http://en.wikipedia.org/wiki/Network Solutions#Controversies
7 http://global.sitesafety.trendmicro.com/
8 http://www.mcafee.com/threat-intelligence/domain/9

Typosquatting saturation (%)

saturation per authoritative domain category in time, we show
an averaging over time. In order for the results to be representative, authoritative categories containing less than 10 domains
have been excluded.
We can see from the figure that adult sites are targeted
the most and that adult typosquatting domains are clearlytargeting adult authoritative domains more often than othertypes of authoritative domains. The social networking category comes second and also experiences some adult typosquatting, caused mainly by the typosquatting domains ofodnoklassniki.ru and renren.com. There are also
substantial differences in the contribution of the affiliate abuseor scam typosquatting domains between the different authoritative categories. It would be wrong to attribute these differences
to the fact that some authoritative categories (e.g. marketplaceand shopping) are more likely to offer an affiliate program
than others, because a typosquatting site in the affiliate abuse
category does not necessarily exploit an affiliate program of
its own authoritative site. In fact, we saw many cases oftyposquatting domains exploiting an affiliate program of an
unrelated domain during our manual classification. Hence,
we cannot pinpoint a specific reason for this difference inthe contribution of the affiliate abuse or scam typosquatting
domains between the different authoritative categories basedon our data.

70

Court
UDRP
Custom

60
50
40
30
20
10
0

pl

ru com ituk

fr org deincn net brjp

Fig. 11. The typosquatting saturation per TLD, for those TLDs with at least 5
domains in our top 500 list. The different patterns indicate the type of dispute
arbitration provided.

A second way in which local domain authorities have an
influence on the prevalence of typosquatting, is in their pricesetting. Obviously typosquatting can only be profitable if therevenue from a domain name is greater than its cost. Hence, we
can expect more expensive TLDs to attract less typosquatters
than cheaper TLDs.
A final policy component that can have an effect on
typosquatting, is the restrictions placed by registry operators
on registrants that can apply for a domain name. For instance,some country-code registry operators require registrants to bea citizen of the corresponding country or to have a local
correspondence address. This makes it more difficult (andhence more expensive) or even impossible for foreign parties
to legally register a domain name under those TLDs, hence
potentially lowering their attractiveness for typosquatters.

K. Influence of TLD
The Internet Corporation for Assigned Names and Numbers (ICANN) is responsible for coordinating the global domain name system, but has delegated the responsibility ofmanaging top-level domains to other commercial or nonprofit organizations, known as registry operators. This is true
for generic TLDs (.com, .org, .net, etc.) as well as forcountry-code TLDs (.de, .jp, etc.). These registry operators
may also fulfill the role of registrar, or may delegate this
responsibility to other companies. A registrar must be officiallyaccredited by ICANN for it to directly do business with aregistry operator, while non-ICANN-accredited registrars canonly be resellers for other registrars. For the generic TLDs, allaccredited registrars have adopted the Uniform Domain-Name
Dispute-Resolution Policy (UDRP) [14]. This is a policy tobe agreed between a registrar and a registrant for a domainname registration, giving an official domain dispute panel theright to take down or transfer ownership of the domain in casea third party complainant can prove the registration violates
her rights. The goal of this policy is to reduce the prevalenceof cybersquatting by saving the complainant from having tostart an expensive court procedure in order to take down thedomain.

Fig. 11 shows the typosquatting saturation per TLD, for
the TLDs with at least 5 domains in our top 500 list. The
typosquatting saturation per TLD does not change significantly
over time, hence we show an averaging over time. The different
bar patterns in the figure indicate the type of dispute arbitration
provided by the corresponding TLD authority. “Court” means
the authority provides no out-of-court arbitration whatsoever,“UDRP” means the authority has adopted the UDRP and“Custom” means the authority implements some custom formof out-of-court arbitration. We can see that the two TLDs
without an out-of-court arbitration option have the highest
typosquatting saturation.
On the other side of the scale, the Brazilian TLD and especially the Japanese TLD have a significantly lower typosquatting saturation. Since we did not find any evidence to indicatethat domain names under these TLDs are particularly difficult
to obtain, we believe the scarcity of typosquatting domains forthese TLDs can be attributed to the high cost of acquiring suchdomains. We calculated the yearly price of a domain underthese TLDs by averaging the yearly price advertised by the
global top 3 domain registrars9 GoDaddy, eNom and Network
Solutions, and found that a .com.br domain costs $43 and a.jp domain costs $107, while domains under all other TLDs
shown in Fig. 11 sell for less than $15. Clearly, these higher
domain prices are effective at deterring typosquatters. Basedon the steep drop in typosquatting saturation between the .br
and .jp domains, we can estimate the annual revenue of atyposquatting domain of a popular website to be somewhere
between $43 and $107. However, since there are still plenty

While this policy is being applied for all generic TLDs,
not all country-code TLDs follow the same approach. Somecountry-code TLD registry operators that do not implement
the UDRP have decided to implement their own similar outof-court domain dispute resolution, but others only intervene
in disputed registrations after an official court ruling. This canpotentially have an influence on the prevalence of typosquatting in those TLDs. In particular, we can expect that TLDs
providing a swift, out-of-court procedure for domain disputes
have fewer typosquatting domains than those that do not.

9 According to http://www.webhosting.info/registrars/top-registrars/global/

10they do not perform a longitudinal study and thus do notinclude the parameter of time in their reported results.

of domains available under cheap TLDs, there is also no real
incentive for typosquatters to target the more expensive TLDs,
hence the annual revenue might actually be higher.
IV.

Halvorson et al. [12] recently showed that over threequarters of the domains registered with the .xxx TLD are
defensive registrations where companies and individuals preemptively register their trademarks with the .xxx extension,e.g., obama.xxx and president.xxx, out of fear thatsomeone could, in the future, use these domains to harm theirimage.

R ELATED WORKTo the best of our knowledge, our work is the first contentbased study that examines the problem of typosquatting intime. Prior work on typosquatting almost always operated bytaking a snapshot of the typosquatting problem and characterizing that snapshot, or by limiting the longitudinal aspectof the study to domain registration records only. Our work iscomplementary to this type of prior work because it adds to theunderstanding of typosquatting abuse and reveals trends that
otherwise remain hidden. In this section we review prior workon typosquatting as well as other types of domain squatting
attacks.

Moore and Edelman performed a similar study for discovering typosquatting domains in 2010 [16] and estimated thatapproximately one million typosquatting domains targeted the
top 3,264 .com sites. The authors also bring attention to thefact that large advertising networks willingly cooperate with typosquatters by showing ads on the mistyped domains. As such,these networks can be held equally responsible for the damage
against the authoritative domains that are being attacked. Next
to the use of ads as a monetization strategy, there have also
been documented cases of typosquatting domains used to serve
malware [9]. Nikiforakis et al. [20] showed that typosquatting
can also occur outside the confines of a browser’s address bar,in remote JavaScript inclusions. There, developers mistype thedomains of remote code providers and thus make their sites
susceptible to malicious script injections served through theappropriate mistyped domains.

Cybersquatting: Cybersquatting refers to the registrationof domains that include trademarks belonging to other persons and companies. Cybersquatting was popular in the earlynineties, when long-existing brick-and-mortar companies did
not yet operate websites. Various opportunists registered theirtrademarks as domain names before them, so that they would
sell the domains back to their rightful owners for profit [11].
Today, this type of domain squatting is not as popular,
since companies usually register all appropriate domains wellbefore the company and its trademarks become popular. There
are, however, still cases where opportunists try to speculate
the name of future products and services and register them,
before the company marketing the product or service gets achance to.10 This phenomenon has been studied by Coull etal. [5] together with other domain registration abuses, such as
domain-name front running.

Szurdi et al. [23] recently investigated typosquatting registrations targeting .com domains that are in the “long tail” ofthe popularity distribution. The authors present a tool named
Yet Another Typosquatting Tool (YATT), which uses passive
domain features and (optionally) active domain features such
as DNS, WHOIS and content information, to identify andcategorize typosquatting domains into categories similar toours. The authors use this tool to classify 4.7 million potential
typosquatting .com domains derived from the Alexa top 1 million. Their results indicate that, although the typosquatting
saturation decreases for less popular authoritative domains, it
is still at 40% near the Alexa 1 million rank and an estimated
20% of all .com domains appear to be typosquatting domains.
The study also includes a longitudinal component, tracking thedomain registrations between October 2012 and October 2013
based on daily dumps of the .com zone file. In contrast to ourstudy, the content of these domains is not taken into account for
the longitudinal analysis. That is, when a new domain appears
in the zone file, it is compared against the list of all potential
typosquatting domains generated from the Alexa 1 million, todetermine whether or not it is an active typosquatting domain.
The authors find, amongst other results, that typosquatting
domains of popular authoritative domains appear to change
hands much more frequently than other domains.

Typosquatting: Cybersquatting evolved into typosquatting,i.e., the act of registering domains that are mistypes of popular
authoritative domains, with the intention of capturing the trafficof users who mistype URLs in their browser address bar. This
practice can be traced back to over 15 years, since the 1999
Anticybersquatting Consumer Protection Act (ACPA) alreadymentioned URLs that are “sufficiently similar to a trademarkof a person or entity” [1].
Edelman, in 2003, reported on thousands of mistyped andcybersquatting domains that served sexually-explicit content,
which were likely registered by the same individual [8].
Wang et al. [25] later described a system for automaticallydiscovering and analyzing typosquatting by simulating typing
errors. The researchers also brought attention to the fact thatthe majority of the discovered typosquatting domains werepointing to companies specializing in domain parking, whichwere used to automatically serve ads related to the mistyped
domain name. In this paper, we used Wang et al.’s models
to generate typosquatting domains for our seven-month longstudy.

Finally, Vissers et al. [24] very recently performed a study
which explored the ecosystem of domain parking services.
While these services have previously been investigated in thecontext of cybersquatting, this study explores the domain parking ecosystem in its own right. The authors discover, among
other results, that between 1.63% and 9% of the investigatedparking domains are typosquatting domains. The study also
shows that some of the investigated parking service providers
have a significantly higher ratio of typosquatting domains
than others, with only one provider serving no typosquatting
domains at all.

Banerjee et al. [2] showed that typosquatting extends
beyond the models of Wang et al., including the abuse of
domain suffixes, such as typosquatting .org domains, for theequivalent .com authoritative ones. Even though the authors
have collected typosquatting data over a two-month period,
10 Parked domain with ads - www.iphone9.com

11defensively registering typosquatting domains for their own domains, (2) over 75% of all possible typosquatting domains for
short popular authoritative domains are already registered, andthat typosquatters are increasingly targeting longer domains,(3) typosquatters are varying their monetization strategy overtime, (4) some companies choose not to renew their defensive
registrations of typosquatting domains, leading these domains
back into the eager hands of typosquatters, (5) up to 50%
of all typosquatting domains can be traced back to just fourtyposquatting page hosters and (6) certain top-level domains
are much less prone to typosquatting than others, due to theirprice setting and local registration and arbitration policies. We
hope this paper and the corresponding dataset, which has been
made publicly available online, can serve as a new reference
for the state of the typosquatting landscape.

Homograph attacks: In domain-homograph attacks, attackers take advantage of the perceived visual similarity between
two or more letters, in order to trick the user into believing that
she is interacting with a specific authoritative website while
she is interacting with a malicious one. This confusion can beabused to convince users to willingly submit their credentials
and other sensitive information. The main difference between
these attacks and the previously mentioned domain squatting
attacks, is that the homograph domains are usually spread-out
through spam emails and social networks, instead of relying
on user mistakes, since their construction cannot usually beachieved through typical typing mistakes.
Gabrilovich and Gontmakher showed that characters fromnon-Latin character-sets that look like Latin characters canbe substituted to confuse the user of the nature of agiven domain [10]. For instance, an attacker could register
paypal.com using the Cyrillic letter P (lower case “r”,
Unicode U+0440), which looks almost identical to the Latin
letter “p”. Today, this type of attack is significantly harder sincebrowser vendors revert to the punycode format of URLs [4],whenever they think that a domain is maliciously crafted.

ACKNOWLEDGMENTS
We thank Christian Kreibich and our anonymous reviewers
for their valuable comments and suggestions that have improved the quality of this paper. This research was performed
with the financial support of the Prevention against Crime
Programme of the European Union (B-CCENTRE), and the
Research Fund KU Leuven. We acknowledge the support of
EURid, the European Registry of Internet Domain Names.
Pieter Agten holds a PhD fellowship of the Research Foundation - Flanders (FWO).

Dhamija et al. [6], investigate why phishing works, andmention “visually deceptive text”, i.e., domains that substitutecharacters with look-alikes within the same character-set, suchas bankofvvest.com (two “v”s instead of a “w”). Holgers et al. [13] performed a large-scale study of homographattacks by gathering popular domains and searching for their
homographed versions. Their results showed that, even though
the monetization strategies of homograph domains are very
similar to traditional domain squatting, the practice of registering homograph domains is significantly less popular thantyposquatting.

R EFERENCES[1][2]

Other types of domain squatting: In 2011, Dinaburg
proposed a new type of domain squatting, bitsquatting [7].
Dinaburg hypothesized that random bit-flips that occur in
hardware memory that is failing or operating outside normal
temperatures, can be abused for domain squatting purposes,
assuming that the flips would occur in the bits holding the
textual representation of a domain name. Domain squatters canregister domains that have a one-bit difference from popular
authoritative domains and capture the traffic resulting fromsuch erroneous bit-flips. Dinaburg registered 30 bitsquatting
domains, such as mic2osoft.com, and recorded more than
50,000 requests over an eight-month period. Later researchshowed that domain squatters have already adopted this technique [18]. Recently, Nikiforakis et al. also discovered thatdomain squatters, next to typos, are also abusing the soundsimilarity of words to construct malicious squatting domains
and attract users to them [19].

[3]

[4]

[5]

[6]

[7]
[8]
[9]

V.

C ONCLUSION[10]

Typosquatting has been known and studied for over 15
years, yet we have shown that it remains a popular form of
domain abuse up until this day. By performing the first contentbased longitudinal study of typosquatting abuse, we haveinvestigated to what extent previously discovered typosquatting
trends still hold today, and have also discovered many new
typosquatting facts. Our main results include that (1) few
trademark owners protect themselves against typosquatting by

[11]

[12]

12

“Anticybersquatting Consumer Protection Act (ACPA),” http://www.
patents.com/acpa.htm, November 1999.
A. Banerjee, D. Barman, M. Faloutsos, and L. N. Bhuyan, “Cyber-fraud
is one typo away,” in Proceedings of the 27th Conference on Computer
Communications, IEEE INFOCOM, 2008.
A. Banerjee, M. S. Rahman, and M. Faloutsos, “Sut: Quantifying
and mitigating url typosquatting,” Comput. Netw., vol. 55, no. 13, pp.
3001–3014, Sep. 2011. [Online]. Available: http://dx.doi.org/10.1016/j.
comnet.2011.06.005
A. Costello, “Punycode: A Bootstring encoding of Unicode for Internationalized Domain Names in Applications (IDNA),” http://www.ietf.
org/rfc/rfc3492.txt.
S. E. Coull, A. M. White, T.-f. Yen, F. Monrose, and M. K. Reiter,“Understanding domain registration abuses,” in Proceedings of the 25th
International Information Security Conference (IFIP SEC), 2010.
R. Dhamija, J. D. Tygar, and M. Hearst, “Why phishing works,”
in Proceedings of the SIGCHI conference on Human Factors incomputing systems, ser. CHI ’06. ACM, 2006. [Online]. Available:
http://doi.acm.org/10.1145/1124772.1124861
A. Dinaburg, “Bitsquatting: DNS Hijacking without Exploitation,” inProceedings of BlackHat Security, July 2011.
B. Edelman, “Large-scale registration of domains with typographicalerrors,” September 2003.
F-Secure, “W32/Googkle,” http://www.f-secure.com/v-descs/googkle.
shtml.
E. Gabrilovich and A. Gontmakher, “The homograph attack,”
Communucations of the ACM, vol. 45, no. 2, p. 128, Feb. 2002.
[Online]. Available: http://doi.acm.org/10.1145/503124.503156
J. Golinveaux, “What’s in a domain name: Is cybersquatting trademark
dilution?” in University of San Francisco Law Review 33 U.S.F. L. Rev.
(1998-1999), 1998.
T. Halvorson, K. Levchenko, S. Savage, and G. M. Voelker, “XXXtortion?: Inferring Registration Intent in the .XXX TLD,” in Proceedingsof the 23rd International Conference on World Wide Web, ser. WWW’14, 2014, pp. 901–912.

[13]

[14]

[15]

[16]

[17]

[18]

[19]

[20]

T. Holgers, D. E. Watson, and S. D. Gribble, “Cutting through theconfusion: a measurement study of homograph attacks,” in Proceedingsof the 2006 USENIX Annual Technical Conference, 2006. [Online].
Available: http://dl.acm.org/citation.cfm?id=1267359.1267383
ICANN,“Domainnamedisputeresolution
policies,”
https://web.archive.org/web/20141028140919/https://www.icann.
org/resources/pages/dndr-2012-02-25-en, accessed: 2014-12-01.
J. Lewis and S. Baker, “The economic impact of cybercrime and cyberespionage,” Center for Strategic and International Studies, Washington,
DC, 2013.
T. Moore and B. Edelman, “Measuring the perpetrators and fundersof typosquatting,” in Financial Cryptography and Data Security, vol.
6052, 2010, pp. 175–191.
D. Müllner, “fastcluster: Fast Hierarchical, Agglomerative Clustering
Routines for R and Python,” Journal of Statistical Software,
vol. 53, no. 9, pp. 1–18, 5 2013. [Online]. Available: http://www.jstatsoft.org/v53/i09
N. Nikiforakis, S. V. Acker, W. Meert, L. Desmet, F. Piessens, and
W. Joosen, “Bitsquatting: Exploiting bit-flips for fun, or profit?” inProceedings of the 22nd International World Wide Web Conference(WWW), 2013.
N. Nikiforakis, M. Balduzzi, L. Desmet, F. Piessens, and W. Joosen,“Soundsquatting: Uncovering the use of homophones in domain squatting,” in Proceedings of the 17th Information Security Conference (ISC),
2014.
N. Nikiforakis, L. Invernizzi, A. Kapravelos, S. Van Acker, W. Joosen,
C. Kruegel, F. Piessens, and G. Vigna, “You Are What You Include:

[21]
[22]

[23]

[24]

[25]

13

Large-scale Evaluation of Remote JavaScript Inclusions,” in Proceedings of the ACM Conference on Computer and Communications Security(CCS), 2012.
Recap, “Microsoft corporation v. shah et al,” http://archive.recapthelaw.
org/wawd/166997/, accessed: 2014-07-29.
C. Roth, M. Dunham, and J. Watson, “Cybersquatting;typosquatting
Facebooks $2.8 million in damages anddomainnames,”
http://www.lexology.com/library/detail.aspx?g=7088bf09-8a9e-4449-a179-d90bdfad3310.
J. Szurdi, B. Kocso, G. Cseh, J. Spring, M. Felegyhazi,
and C. Kanich, “The long “taile” of typosquatting domainnames,” in 23rd USENIX Security Symposium (USENIX Security
14).
San Diego, CA: USENIX Association, 2014, pp.
191–206. [Online]. Available: https://www.usenix.org/conference/
usenixsecurity14/technical-sessions/presentation/szurdi
T. Vissers, W. Joosen, and N. Nikiforakis, “Parking Sensors: Analyzing
and Detecting Parked Domains,” in Proceedings of the ISOC Network
and Distributed System Security Symposium (NDSS ’15), Feb 2015.
[Online]. Available: http://dx.doi.org/10.14722/ndss.2015.230053
Y.-M. Wang, D. Beck, J. Wang, C. Verbowski, and B. Daniels, “Strider
typo-patrol: discovery and analysis of systematic typo-squatting,” inProceedings of the 2nd conference on Steps to Reducing Unwanted
Traffic on the Internet - Volume 2, ser. SRUTI’06. Berkeley, CA,
USA: USENIX Association, 2006, pp. 5–5. [Online]. Available:
http://dl.acm.org/citation.cfm?id=1251296.1251301