80% of mistyped URLs lead to typosquatting sites - Sophos study
IT security and data protection company Sophos is cautioning computer users to be careful how they type, a timely reminder with the silly season in full swing, following the publication of a Sophos study into the scale of 'typosquatting'.
Typosquatters register mis-spellings of popular websites in the hope that they will be able to make money out of traffic from typing mistakes made by internet surfers.
Sophos looked at typosquatting targeting its own website as well as those of Facebook, Google, Twitter, Microsoft and Apple. The study looked for registered websites for every single one-letter typo of the company name: one letter omitted (e.g. Sopos), one letter mistyped (e.g. Saphos), or one letter added (e.g. Ssophos).
The study revealed the sheer scale of the typosquatting ecosystem around high-profile domain names, collecting HTTP data and browser screenshots from 1502 web sites and 14,495 URLs. As an example, a huge 86% of the possible one-letter typos of the Apple homepage led directly to typosquatting sites.
"A good web security product can protect you from the most egregious typosquatting sites," said Sophos's Paul Ducklin, Head of Technology, Asia Pacific. "But even with technological help, it's inevitable that from time to time a typo will take you to an unintended website. When that happens, please don't be tempted to click through from the unexpected page, even if what you are apparently offered is a link to your intended destination."
Ducklin doesn't mince his words to explain this stance. "Why trust a site you didn't want to visit in the first place? Why feed an economy which is based upon profiting from other people's mistakes?"
You can also watch a brief 50-second video explaining the research, and urging computer users to type 'carefumbly' this Christmas here:
http://www.youtube.com/watch?v=OtfhSWAb1gQ
Highlights of the Sophos report include:
* 2249 typosquat domains generated
* 1502 domains registered and listed in DNS overall (67%)
* Over 80% of typosites registered for high-profile brands
* All live sites visited, logged and screen-shotted for the report
* 14,495 URLs downloaded whilst visiting the live sites
* Only one URL directly contained malware
* 738 URLs (5.1%) classified as cybercrime or adult
* 560 of 1502 typosites (37%) make use of Google's DoubleClick subsidiary
* Bait-and-switch and brand-hijack sites common
* A few humorous or satirical sites are included in the mix
More information about the study, including the full report, images and graphs, can be found on Sophos's Naked Security website:
http://nakedsecurity.sophos.com/typosquatting/
Get in touch with Paul Ducklin for comment:
+61.407.320.515
For further information and high-resolution versions of all images in the report please contact Amanda Conroy on 02 9904 4177 or amanda@espressocomms.com.au
