How a Simple URL Typo Can Make You a Target for Malware

Navigating through search results to a website carries the risk of landing on a fake page that is actually a phishing scam, but so does navigating directly by typing the URL into your browser. How Krebs Security reportedResearchers from the security company Infoblox have revealed a whole range of scams on similar and parked domains (or placeholder domains). If you end up on one of these websites, you will not be redirected to the trusted page you would expect, but to fraudulent content, including scareware and other malware.

Similar domains contain malicious content

This scam relies on you going directly to a website by typing the URL into your browser's address bar. If you accidentally type a top-level domain (TLD) (such as .gov or .com) or a second-level domain (SLD) that is the name of a company (Google or Amazon), you may end up on a page that has been hijacked by attackers for malicious purposes.

In some cases, these may be typos, meaning cybercriminals have registered domain names that look almost identical to trusted ones. In other cases, they may be actual expired domains and simply advertising placeholders that distribute malware.

Infoblox researchers found that visiting one of these sites often initiates a chain of redirects through which attackers profile data such as the geolocation of your IP address, device fingerprints and cookies. This means that you do not have to click any links on the parked page to receive the malicious content. However, they note that the parked websites were only malicious if visited from a home IP address, and safe if accessed using a VPN or non-resident IP address.

How to Avoid Parked Domain Scams

One common tip to avoid phishing websites is to enter trusted URLs directly into the address bar rather than clicking on the search button, as attackers will try to exploit the results, including placement of paid advertisingto redirect you to malicious domains. This can still be a safe way to get to your destination, but you should check the spelling of both the TLD and SLD carefully, as small mistakes can lead you to a scam site.

I've looked at similar website tricks like homography attackswhich use similar characters in URLs to direct you to phishing sites that appear to be legitimate domains at first glance. Unless you check the address very carefully, you may not be able to detect fraud.