Typosquatting

Description

With domains, the user believes they are opening a familiar site but ends up on a fake page for credential theft, malware distribution or advertising. With software packages, a developer installs a package whose name resembles a popular library and actually gets malicious code.

This is a simple attack because it uses speed and routine. People do not read every letter of a domain, and build systems do not consider a package's intent. One wrong character can be enough for trust to go to the wrong address.

Examples

• A domain with one changed letter imitates a well-known service and shows a fake login page.
• A package in the PyPI or npm registry has a name similar to a popular library but runs malicious code on installation.
• An attacker registers several similar domains around a brand and uses them for a phishing campaign.

Notes

• Typosquatting is not only a problem for users who mistype. It is also a problem for developers, package registries and brands.
• Defensive registration of similar domains helps but does not cover every variant. Monitoring is not optional.