Typosquatting as Corporate Espionage

Typosquatting, that seedy practice of registering domain names similar to legit sites but with typos in the name, has a new twist.

At a Black Hat presentation last week on a Symantec long-term research on the practice as it cropped up in the 2008 election campaign, Oliver Friedrichs found an interesting tidbit. A typosquatting domain registered to someone in China had no Web page, but it did have a record that allowed it to receive e-mail.

While there isn't any conclusive evidence of spying, typosquatting is normally done to catch accidental Web surfers. When people mistype a domain name - such as johnmcain.com instead of johnmccain.com - they end up at the typosquatting site instead of getting a page not found error. The junk site typically displays ads.

But this registered domain, the name of which Friedrichs didn't reveal, didn't have any Web site records or associated pages to catch ad revenue. Instead, it had what's known as an MX record, which allows it to receive e-mail.  The strong implication is that whoever registered the typosquatting domain wanted to get e-mail intended for the real company. 

Without direct evidence it's a leap to assume this was done for spying purposes, but it's not exactly a giant vault. Chinese registrant, defense contractor, MX record with no associated (and potential tip-off) Web site. Connect the dots.

If this was meant for espionage, it would only collect e-mails with mis-typed addresses that matched the typosquatting domain.  Not a massive risk since the majority of e-mail clients auto-fill the address based on an entry in the contact list. But it's so cheap and easy to register a domain and throw up a quick mail server that even a few collected e-mails could be easily worth a spy's time.

So if you're in a company that deals in sensitive information and you think you might be a corporate espionage target, it sure couldn't hurt to proactively check to see if anyone has registered typosquatting domains based on your company's domain name. Type potential domain names (typosquatting variants) into the Whois tool at http://whois.domaintools.com to see if anything turns up.