Forest Global Training Partners

Cyber Risks · Krebs on Security

Omitting the “o” in .com Could Be Costly

Summary: More than a thousand typosquatting domains on the .cm country-code top-level domain, including espn.cm, aetna.cm, chase.cm, facebook.cm and walmart.cm, are hosted on a single Internet address (85.25.199.30) and redirect visitors to one of two landing pages. KrebsOnSecurity traced registration records for those pages and 1,500+ other domains to an email address whose Yahoo password-recovery contact resolves to an employee of Media Breakaway LLC, a Colorado marketing firm headed by Scott Richter, who pleaded guilty in 2003 to felony grand larceny and whose former company OptInRealBig faced a $500 million judgment.

What you should know: A single mistyped letter sends a user to a network of over a thousand lookalike domains for banks, insurers and retailers, and researcher Matthew Chambers found the payload links work only once and the exploit code goes dormant to evade scanners. The brands being impersonated have UDRP recourse, but the article notes that process does not apply to .cm, leaving the trademark holders without that path.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related