Typosquatting

An incorrectly entered URL could lead to a website operated by a cybersquatter.

Typosquatting, also called URL hijacking, is a form of cybersquatting, and possibly brandjacking which relies on mistakes such as typographical errors made by Internet users when inputting a website address into a web browser. Should a user accidentally enter an incorrect website address, they may be led to any URL (including an alternative website owned by a cybersquatter).^[1]

Overview

The typosquatter's URL will usually be one of four kinds, all similar to the victim site address:

(In the following, the intended website is "example.com")

• A common misspelling, or foreign language spelling, of the intended site: exemple.com
• A misspelling based on typing errors: xample.com or examlpe.com
• A differently phrased domain name: examples.com
• A different top-level domain: example.org

Once in the typosquatter's site, the user may also be tricked into thinking that they are in fact in the real site; through the use of copied or similar logos, website layouts or content.

Motivation

There are several different reasons for typosquatters buying a typo domain:

• In order to try and sell the typo domain back to the brand owner
• To "park" the typo domain and make pay-per-click revenues from direct navigation miss-spells of the intended domain
• To redirect the typo-traffic to a competitor
• To redirect the typo-traffic back to the brand itself, but through an affiliate link, thus earning commissions from the brand owner's affiliate program. This "typo domain affiliate" is one of the most financially damaging schemes as it siphons profits from the legitimate brand for traffic/customers that the brand would have gotten anyway had the typo domain not existed.
• As a phishing scheme to mimic the brand's site, while intercepting passwords which the visitor enters unsuspectingly
• To install drive-by malware or revenue generating adware onto the visitors' devices
• To harvest misaddressed e-mail messages mistakenly sent to the typo domain
• To block malevolent use of the typo domain by others

Examples

Many companies, including Verizon, Lufthansa, and Lego, have garnered reputations for aggressively chasing down typosquatted names. Lego, for example, has spent roughly $500,000 USD on taking 309 cases through UDRP proceedings.^[2]

Celebrities have also frequently pursued their domain names, from singers to star athletes. Prominent examples include Basketball player Dirk Nowitzki's UDRP of DirkSwish.com ^[3] and actress Eva Longoria's UDRP of EvaLongoria.org.^[4]

An example of corporate typosquatting is yuube.com, targeting YouTube users.^[5] Similarly, www.airfrance.com has been typosquatted by www.arifrance.com, diverting users to a website peddling discount travel.^[6]

In United States law

In the United States, the 1999 Anticybersquatting Consumer Protection Act (ACPA) contains a clause (Section 3(a), amending 15 USC 1117 to include sub-section (d)(2)(B)(ii)) aimed at combatting typosquatting.^[7][8]

However, on April 17, 2006, controversial evangelist Jerry Falwell failed to get the U.S. Supreme Court to review a decision allowing Christopher Lamparello to use "www.fallwell.com". Relying on a plausible misspelling of Falwell's name, Lamparello's gripe site presents misdirected visitors with scriptural references that counter the fundamentalist preacher's scathing rebukes against homosexuality. In Lamparello v. Falwell, the high court let stand a 2005 Fourth Circuit finding that "the use of a mark in a domain name for a gripe site criticizing the markholder does not constitute cybersquatting."

WIPO resolution procedure

Under the Uniform Domain-Name Dispute-Resolution Policy (UDRP), trademark holders can file a case at the World Intellectual Property Organization (WIPO) against typosquatters (as with cybersquatters in general).^[6] The complainant has to show that the registered domain name is identical or confusingly similar to their trademark, that the registrant has no legitimate interest in the domain name, and that the domain name is being used in bad faith.^[6]

See also

• Damerau–Levenshtein distance
• DNS
• Doppelganger domain
• IDN homograph attack
• Misdialed call#Toll-free numbers (for similar attacks on vanity toll-free telephone number phonewords)
• Mousetrapping
• Phishing

References

External links

• Jim Giles: Typos may earn Google $500m a year New Scientist, 17 February 2010 (reporting research by Ben Edelman and Tyler Moore: Measuring Typosquatting Perpetrators and Funders)
• "The Internet Commerce Association Code of Conduct". InternetCommerce.org. Retrieved 2007-09-13. "The Internet Commerce Association’s (ICA) Member Code of Conduct expresses the ICA’s recognition of the responsibilities of its members to the intellectual property, domain name, and at large Internet communities and will guide members in conducting their domain name investment and development activities with professionalism, respect and integrity." 
• "The Coalition Against Domain Name Abuse to Combat Cybersquatting". ComplianceAndPrivacy.com. Retrieved 2007-09-20. "With growing ease and profitability, sophisticated cybersquatters are exploiting a flaw in the domain name registration process whereby domain names are registered and subsequently dropped, risk free, within an accepted 5-day grace period." 
• "TypoSquatting". Retrieved 2013-02-27. "Web tool which shows lots of mistyped registered domains (German)."