Typosquatting

Typosquatting, or URL hijacking, consists of registering slightly modified variants of a famous domain name in order to capture errant traffic or impersonate the legitimate site. Exploited variants include nearby typing errors on a QWERTY keyboard, substitution of visually similar characters known as homoglyphs, such as the digit zero in place of the letter o, the omission or addition of a hyphen, and combo-squatting which appends a generic word to the legitimate domain such as bank-secure or paypal-login. Having appeared as an opportunistic commercial practice in the 1990s to capture distracted visitors, typosquatting has become a structured attack vector with the proliferation of targeted phishing. In software supply chain attacks, package typosquatting, also known as dependency confusion or package squatting, involves publishing on public registries such as PyPI or npm packages whose name imitates that of a company's internal library, in the hope that the dependency manager downloads them in place of the legitimate version. This variant was demonstrated at scale by researcher Alex Birsan in 2021, compromising systems at Apple, Microsoft and PayPal. For insurers, typosquatting is a vector for wire fraud, targeted phishing and software supply chain compromise that generates losses whose causal link to a specific policy can be difficult to establish.

An employee at a reinsurance firm types 'reuassurance-corp.com' instead of 'reassurance-corp.com' in their browser. The typosquatted domain displays a perfect copy of the internal HR portal and harvests their credentials. The incident is only detected a week later during an audit. The cyber policy is examined for coverage of phishing via internal domain impersonation.

typosquatting, URL hijacking, détournement de nom de domaine, cybersquatting typographique, sting site, combo-squatting