Microsoft ships 'URL Tracer' to find typo-squatters
Microsoft Research has released a new tool to help pinpoint large-scale typo-squatters that are known to be gaming pay-per-click domain parking services. The lightweight prototype, called Strider URL Tracer, builds on the work within Microsoft's Cybersecurity and Systems Management group to keep tabs on a sophisticated typo-squatting scheme that uses multilayer URL redirection to make money from Google's AdSense for domains program. Yi-Min Wang, who heads up the group's work in Redmond, Wash., said URL Tracer can be used as a parental control tool to block inappropriate ads from being served from Web sites that are set up to deliberately lure kids who accidentally misspell a popular domain. One live example, Wang said, is the way the virtual pet site at NeoPets.com has been targeted by typo-squatters to serve pornographic-themed ads if it is misspelled. One such misspelling, neoppets.com, is currently serving ads promising naked photos of Britney Spears or other adult images. He said the group analyzed typo-squatting on 50 popular children's sites and found more then 7,000 typo-domains. About 2,685 of those domains were active, and a total of 110 were serving questionable content. "Four domains redirected to adult sites directly, 36 domains contained at least one conspicuous link to an adult site, and the remaining domains displayed at least one conspicuous adult-category link to a page of adult ads listings," Wang said. Most of the ads were being served from Oingo.com, a domain parking service that powers Google's popular Adsense for domains program. The domain parking service is aimed at websites that generate more than 750,000 page views per month and, according to Google's own boast, Adsense for domains is now powering over 3 million domain names. "This is a huge, lucrative business," Wang said, noting that the typo-squatters have been monitoring his group's published work "on a daily basis" and have been moving domains being parking services to dodge detection. Wang's group has meticulously tracked the typo-squatting scheme for several months as part of its Strider Typo-Patrol project, and he says it's clear that big-name trademark owners with high-traffic websites are a major target. In an interview with eWEEK, Wang said URL Tracer can also serve as a typo-patrol tool used by trademark owners who want to monitor typo-domains. "It is often too expensive for target-domain owners to investigate and take actions against a large number of individual typo-domains," he said, adding that a feature built into URL Tracer can take a target domain name and automatically generate and scan its typo-neighbourhood. The tool uses five programmatic typo-generation models—deliberate missing-dot typos, character omission typos, character permutation typos, character replacement typos and character insertion typos—to pinpoint potential domain-registration structures that are being used to steal traffic from large brands. Wang said high-traffic properties that are a constant target include MySpace.com, Slashdot, Amazon.com, Expedia, Washington Post, New York Times, Microsoft.com and DisneyChannel.com. Deliberately misspelled domains for several major banking and financial services Web sites are also a constant target, he said. For more on this story visit the eWEEK website. UKFast is not responsible for the content of external Internet sites.