Cybercriminals Targeting Misspelled Site Addys

In an age where most of our work is done on computers and spellcheck is only a right click away, taking the time and concentration necessary to spell words out correctly is often overlooked by many computer users.

However security experts are now recommending that users pay extra attention when typing out the addresses of their favourite sites including Google, Netflix and Trip Advisor as more and more cybercriminals are taking advantage of the spelling mistakes users make when using a web browser.

Recently there has been a surge of misspelled domain name registrations that were likely registered by cybercriminals looking to engage in ‘typosquatting.’ By claiming common misspellings of the web addresses of popular sites, attackers are able to set up fake websites that appear similar to the sites users are trying to reach. A user may think that they have reached the site they were looking for when really the fake site could lead them to download a virus or spoof them into entering their personal information.

Typosquatters will often register misspelled sites that have repeated letters such as “googlle.com” or that contain letter that are adjacent to the correct letter such as “googlr.com”. Endgame, a US-based security company, found that a great number of recent fake websites have been registered to “.om”. Although there are actually sites that end with “.om”, they would likely only be used in Oman. Instead typosquatters are targeting users who rush to type out a domain and forget the c in “.com”.

The company found that 334 established brands had a “.om” version of their sites with only 15 being owned by the actual brand. Endgame was able to find an unofficial website for Netflix registered to a “.om” domain that would redirect unaware users to a download page for “Flash Updater”. While the page appear to be legitimate at first glance it actually was malicious in nature.

To avoid falling victim to a typosquatting attack, users should ensure that they spell a site’s domain correctly before proceeding. However if you are rushed for time, using a search engine or your saved bookmarks (that you have checked for correct spelling) might just be an easier route.

Image Credit: Thinglass / Shutterstock

Author: Anthony Spadafora
View the original article here.
Published under license from ITProPortal.com