Typosquatting and Domain Hijacking

Typosquatting (also known as URL hijacking, cybersquatting, or domain spoofing) is the practice of registering domain names that are deliberate misspellings or variations of popular legitimate domains. The attacker relies on users making typographical errors when typing a URL into a browser. For example, a user intending to visit www.google.com might accidentally type www.gooogle.com (extra 'o') or www.gogle.com (missing 'o'), landing on a malicious site that mimics the real Google page to steal login credentials or serve malware.

Domain hijacking, in contrast, involves gaining unauthorized control over a legitimate domain name by compromising the domain registrar account, exploiting vulnerabilities in the domain registration process, or using social engineering to transfer the domain to a different registrar. Once the attacker controls the domain, they can modify DNS records to point traffic to their own servers, intercept email, or hold the domain for ransom.

Domain hijacking typically follows one of these paths:

Once the attacker controls the domain, they can:

Typosquatting Variants: - Homograph Attacks: Using characters from different scripts that look identical (e.g., Latin 'o' vs. Cyrillic 'о'). These are often called IDN (Internationalized Domain Name) homograph attacks. For example, www.paypal.com where the 'a' is replaced with a Cyrillic 'а' (U+0430). - Combosquatting: Adding or removing common words (e.g., www.google-login.com, www.facebooks.com). - Bitsquatting: Registering domains that differ by a single bit in the domain name's binary representation, exploiting memory errors in hardware. - Soundalike Domains: Domains that sound similar when spoken (e.g., www.texas.com vs. www.texass.com).

Domain Hijacking Variants: - DNS Poisoning: Not technically hijacking but can achieve similar results by corrupting DNS caches. - Domain Transfer Theft: The attacker initiates a transfer to another registrar, often using social engineering to bypass authorization checks. - Registrar Lock Bypass: Domains can be locked to prevent unauthorized transfers. Attackers sometimes trick support into removing the lock.

Against Typosquatting: - Defensive Registration: Companies register common misspellings of their own domains and redirect them to the legitimate site. For example, Google owns www.gooogle.com. - Domain Monitoring: Use services that monitor for newly registered domains similar to your own. - User Awareness: Train users to check the URL carefully, use bookmarks, and avoid clicking links in emails. - Browser Features: Modern browsers warn users when they visit lookalike domains (e.g., Chrome's 'Navigation to a lookalike URL' warning). - DNSSEC: While primarily for integrity, DNSSEC can help prevent DNS spoofing that might be combined with typosquatting.

Against Domain Hijacking: - Registrar Lock: Enable the registrar lock (also called transfer lock) on all domains. This prevents unauthorized transfers without manual unlocking. - Two-Factor Authentication (2FA): Enable 2FA on the registrar account. - WHOIS Privacy: Use WHOIS privacy to hide personal contact information, reducing social engineering risk. - Domain Monitoring: Set up alerts for any changes to domain registration or DNS records. - Strong Passwords: Use unique, complex passwords for registrar accounts. - Regular Audits: Periodically review domain settings and authorized users. - Use Reputable Registrars: Choose registrars with strong security practices and responsive support.

Checking Domain Registration (WHOIS):

whois example.com

This returns registrar, creation/expiry dates, nameservers, and contact info (if not private).

Checking DNS Records:

nslookup example.com
nslookup -type=any example.com

Or using dig:

dig example.com ANY

Monitoring for Typosquatting (using DNSTwist):

dnstwist example.com

This generates a list of potential typosquatted domains and checks if they resolve.

Checking for Homograph Attacks (using Python):

import idna
print(idna.encode('www.paypal.com'))  # will show punycode if non-ASCII

Homograph domains are often registered in Punycode (e.g., xn--paypal-3ve.com).

Preventing Transfer (using registrar API): Most registrars provide a 'lock' command. For example, with Namecheap API:

curl -X POST "https://api.namecheap.com/xml.response?ApiUser=...&ApiKey=...&Command=namecheap.domains.setLock&DomainName=example.com&LockAction=ENABLE"

Scenario 1: Enterprise SOC Detects Typosquatting of Corporate Domain

A security analyst at a large financial institution notices multiple failed login attempts from IP addresses not associated with employees. Reviewing proxy logs, the analyst sees that some employees are visiting www.bankofamerica-secure.com (a typosquatted domain). The analyst uses a tool like DNSTwist to generate a list of potential typosquatted domains and checks if any are active. They find three active lookalike domains hosted on the same IP range. The analyst reports to the incident response team, who then work with the legal department to send cease-and-desist letters to the hosting provider. The analyst also blocks the malicious domains on the corporate proxy and sends an awareness email to all employees about verifying URLs. A common mistake in this scenario is that the analyst only blocks the specific domain reported, missing other related typosquatted domains. The correct response is to proactively monitor for all variations and implement a domain monitoring service.

Scenario 2: Domain Hijacking of a Small Business

A small e-commerce company receives an email from their registrar stating that a domain transfer request has been initiated. The owner did not authorize this. They quickly log in to the registrar account and see that the transfer lock was disabled and the domain is pending transfer. The attacker had used a phishing email to trick the owner into revealing credentials, then logged in and disabled the lock. The owner contacts the registrar's support immediately and reverts the transfer. They enable 2FA and change the password. The attacker's attempt fails because the domain was still in the 5-day transfer pending period. A common mistake is that the owner ignores the email thinking it's spam, or delays action until after the transfer completes, making recovery much harder.

Scenario 3: Homograph Attack on a Cryptocurrency Exchange

A user receives a phishing email claiming their cryptocurrency exchange account is compromised and they need to verify their identity. The email contains a link to xn--coinbase-3ve.com (Punycode for a Cyrillic homograph of 'coinbase'). The user clicks and enters their credentials. The attacker immediately uses those credentials to log in to the real Coinbase and transfer funds. The exchange's security team detects the unusual login from a new device and locks the account, but the funds are already gone. The correct response for the exchange would have been to implement multi-factor authentication (MFA) and monitor for such homograph domains proactively. The user's mistake was not checking the URL carefully; modern browsers display the Punycode in the address bar, which can be a red flag.