5 ms·

I wonder how likely these errors are

dholowiski 15y ago
This seems like it would be easy to test - register a bit;flipped domain name, set up a simple redirect script to the proper domain name and monitor the hits. A good evening or lunch-time project.
- joshu 15y ago
  You would need something with high traffic.
  - dholowiski 15y ago
    How about Google.com or Facebook.COM?
    - andfarm 15y ago
      As far as I can tell, most or all of the one-bit errors on those are already registered by typosquatters.
      - dholowiski 15y ago
        I hadn't thought of that... I tried flipping the first 7 bits of google and got woogle, ooogle, coogle, eoogle - which are all registered. I don't think it would be that hard to write a bit-flip miner though. It wouldn't surprise me if sites other than the biggest (maybe ycombinator.com, techcrunch.com, makezine.com) have bit flipped versions avilable. I guess it would be more likely with longer domain names too.
        dholowiski 15y ago
        I built a 'bit flip miner' tonight. As expected, every variation of microsoft.com and google.com are registered, but there are many bit flipped versions of ycombinator.com, wordpress.com, and paypal.com (yikes!) are actually available (among others). The best thing would be if the owner of a very busy domain name set up a redirect as I mentioned before (on a domain that would be hard to be a typo), didn't tell anyone, then compared the traffic with the traffic on the real domain.
nbpoole 15y ago
> Normally a couple hundred IPs a day will visit popular bitsquatted destinations. #blackhat https://twitter.com/#!/dakami/status/98910873044791297 https://twitter.com/#!/dakami/status/98910873044791297
- fla 15y ago
  Someone posted a gist wich looks like DNS hits for facebook content delivery network (fbcdn.net) https://gist.github.com/1125307 https://gist.github.com/1125307 plus another one about top domains https://gist.github.com/1125203 https://gist.github.com/1125203 . It seems the odds are around 1 over 1 billion, or even less. Edit : Can it be something else? maybe IP/UDP checksum collision over corrupted packets ?

This seems like it would be easy to test - register a bit;flipped domain name, set up a simple redirect script to the proper domain name and monitor the hits. A good evening or lunch-time project.

joshu 15y ago
You would need something with high traffic.
- dholowiski 15y ago
  How about Google.com or Facebook.COM?
  - andfarm 15y ago
    As far as I can tell, most or all of the one-bit errors on those are already registered by typosquatters.
    - dholowiski 15y ago
      I hadn't thought of that... I tried flipping the first 7 bits of google and got woogle, ooogle, coogle, eoogle - which are all registered. I don't think it would be that hard to write a bit-flip miner though. It wouldn't surprise me if sites other than the biggest (maybe ycombinator.com, techcrunch.com, makezine.com) have bit flipped versions avilable. I guess it would be more likely with longer domain names too.
      - dholowiski 15y ago
        I built a 'bit flip miner' tonight. As expected, every variation of microsoft.com and google.com are registered, but there are many bit flipped versions of ycombinator.com, wordpress.com, and paypal.com (yikes!) are actually available (among others). The best thing would be if the owner of a very busy domain name set up a redirect as I mentioned before (on a domain that would be hard to be a typo), didn't tell anyone, then compared the traffic with the traffic on the real domain.

nbpoole 15y ago

> Normally a couple hundred IPs a day will visit popular bitsquatted destinations. #blackhat https://twitter.com/#!/dakami/status/98910873044791297 https://twitter.com/#!/dakami/status/98910873044791297

fla 15y ago
Someone posted a gist wich looks like DNS hits for facebook content delivery network (fbcdn.net) https://gist.github.com/1125307 https://gist.github.com/1125307 plus another one about top domains https://gist.github.com/1125203 https://gist.github.com/1125203 . It seems the odds are around 1 over 1 billion, or even less. Edit : Can it be something else? maybe IP/UDP checksum collision over corrupted packets ?