Last Updated: January 20, 2010
The Strider Family:
[Flight Data Recorder]
[Patch Impact Analyzer]
See Strider at Assembling an All-Star Team of Research Talent
and Imagining What Comes Next
When a user visits a Web site, her browser may be instructed to visit other third-party domains
without her knowledge. Some of these third-party domains raise
The Strider URL Tracer, available for download, is a tool that reveals these third-party domains,
and it includes a Typo-Patrol feature that generates and scans sites that capitalize on inadvertent
URL misspellings, a process known as typo-squatting. The tool also enables parents to block
typo-squatting domains that
serve adult ads on typos of children's Web sites.
- Yi-Min Wang, Doug Beck, Jeffrey Wang, Chad Verbowski, and Brad Daniels,
"Strider Typo-Patrol: Discovery and Analysis of Systematic Typo-Squatting," Usenix 2nd Workshop on Steps to Reducing Unwanted Traffic on the Internet (SRUTI), July 2006
- Related Papers:
Windows XP/IE6 URL Tracer Download (v. 188.8.131.52, April 7, 2006) ("Save" to Desktop and double-click to install this research prototype)
- This tool is a standalone client-side tool. It does not perform
any lookups on our typo-domain database and it does not
report back any scan results.
- The tool only works with IE6. We do not have a plan to port it to IE7 and IE8.
Quick Start and Help File
Screenshots (typo domains of
- We highly recommend running the scan from a virtual machine or
a non-mission-critical machine.
- "Google Lets Advertisers Opt Out of Domain Parking Sites", March 13th, 2008
- "Microsoft files cybersquatting lawsuits," Sept. 13, 2007
Sues iREIT for Alleged Cybersquatting, April 5, 2007
Expands Global Effort to Combat Cybersquatting," March 14, 2007
Launches Enforcement Campaign Targeting Web Site ï¿½Cybersquattersï¿½ Who Use Online Ads," August 22, 2006
Web's Million-Dollar Typos," The Washington Post, April 30, 2006.
- "Typed too fast? Google profits from your typo," The Seattle Times, April 30, 2006.
- "Google Propping Up Typosquatting Biz?", Slashdot, April 30, 2006.
- "Microsoft spells the end of
typos," ipwalk, April 20, 2006
- "Microsoft Tool To Help Users Avoid Typo Domains,"
Slashdot, April 14, 2006.
Ships 'URL Tracer' to Hunt Down Typosquatters,"
eWeek.com, April 7, 2006.
- "Microsoft 'URL Tracer' Hunts Typosquatters," Slashdot, April 7, 2006.
- "MS Research:
Typo-Squatters Are Gaming Google,"
eWeek.com, December 19, 2005.
- Wikipedia: Typosquatting
Technical Report -
Typo-Patrol: Discovery and Analysis of Systematic Typo-Squatting"
- Summary -
In our three sets of scans, 40%~70% of active
typo domains were parked with the following top six services,
which means trademark owners can easily identify major typo-squatters
by using the Strider URL Tracer to track and categorize ads-fetching traffic sent
to these parking services.
December 19, 2005: This eWeek news article first exposed
the large-scale, systematic typo-squatting activities by major squatters.
In response, oingo.com removed adult
ads served on the typo domain http://disnryland.com.
December 2005 ~ March 2006:
We reported 2,182 oingo-parked and Unasi/Domaincar-owned typo domains
In response, 1,668 of them were de-activated.
April 7, 2006:
We released the Typo-Patrol tool and the technical report. The second eWeek article came out and more adult ads served
on typo domains of children's web sites were removed.
April 24, 2006: Sedo
started blacklisting questionable
typo and non-typo domains reported on this page.
May 7, 2006:
Domain parking services can now use the Strider Global Typo-Domain List to quickly screen for domain parkers whose portfolios appear to contain a large number
of questionable domains.
typo domains of 60 target domains are being used as the Strider Typo-Patrol benchmark "TP-60".
We will periodically scan them and report the results as a way of monitoring
the trend and movement of this industry.
Send email to firstname.lastname@example.org
if you own an Alexa top-500 web site
or a major banking web site and would like to
be added to the benchmark, which in general should discourage typo-squatting of
your web site.
[WhoIs Oingo]: 20%, 19%, and 44% in our three sets of scan data, respectively
- How big is this domain parking business (traffic x revenue per visit):
The most well-known, Panama-based(?) typo-squatter
appears to be a major customer of oingo.com.
- Unasi/Domaincar owns 76%
of all the typo domains parked with oingo.com in our study.
Together, they are sharing profits from serving ads on a large number of
typo domains (see thousands of such domains).
- The real identity of Unasi/Domaincar may be discovered by
following the money trail of Oingo.com's payment to its Client ID
- Our data shows that, when you make a typo and
reach an active domain, one
in every four such domains are parked with oingo.com and
one in every six such domains are
registered to Unasi/Domaincar.
- In response to this eWeek news article, Unasi/Domaincar de-activated
a large number of
"anchor domains" that were used to aggregate
typo traffic and to trick Oingo.com into
serving adult ads
on typo-squatting domains of children's web sites.
- Unasi/Domaincar was responsible for 46 of 110 such domains
found in our study.
- Between December 2005 and March 2006, we reported 2,182 typo domains owned by Unasi/Domaincar and 1,668 of them have been de-activated.
- Unasi/Domaincar and oingo.com are also profitting from serving ads on
a large number of domains that contain non-typo brand names such as Disney, Microsoft, Sony, EBay, Nokia,
Canon, Nintendo, Panasonic, Gucci, Citibank, etc.
- According to
"DomainCar ... and several related companies,
controlled some three million domain names, around four percent of the
- See list of 70+ domain name complaints
- Other major clients (although they all appear to be much smaller than
DTRG4295/Unasi/Domaincar; April 19~20, 2006 data)
[WhoIs DomainSponsor]: 21%, 14%, and 12%
[WhoIs Sedoparking]: 8.6%, 3.3%, and 3.8%
- Clicking on the ads will
send you through http://pagead2.googlesyndication.com (see screenshot).
[WhoIs Qsrch]: 4.5%, 3.3%, and 1.8%
[WhoIs Netster]: 2.9%, 2.2%, and 4.1%
[Whois Hitfarm (identity shielded)]: 2.1%, 3.1%, and 2.3%
- Beyond typo-squatting,
these parking services also park a large number of domains with names containing (non-typo) brand names (April 2006):
- See sample typo traffic statistics at http://slsahdot.org
- Strider Typo-Patrol Project Home Page
- Typo-Squatting-Related Laws
Domain-Name Dispute-Resolution Policy (UDRP), October 24, 1999
- Applicable Disputes. You are required to submit to a mandatory
administrative proceeding in the event that a third party
(a "complainant") asserts to the applicable Provider, in compliance
with the Rules of Procedure, that
- (i) your domain name is identical or confusingly similar to a trademark
or service mark in which the complainant has rights; and
- (ii) you have no rights or legitimate interests in respect of
the domain name; and
- (iii) your domain name has been registered and is being
used in bad faith.
Consumer Protection Act (ACPA), Signed by President Clinton,
November 29, 1999
- A person shall be liable in a civil action by the owner of a mark,
including a personal name which is protected as a mark under this section,
if, without regard to the goods or services of the parties, that person --
(i) has a bad faith intent to profit from that mark, including a
personal name which is protected as a mark under this section; and...
- In a case involving a violation of section 43(d)(1), the plaintiff may elect,
at any time before final judgment is rendered by the trial court, to recover,
instead of actual damages and profits, an award of statutory damages in the
amount of not less than $1,000 and not more than $100,000 per domain
name, as the court considers just.
in Domain Names Act, 2003
- Sec. 2252B. False or misleading domain names on the Internet
- (a) Whoever knowingly uses a misleading domain name with the intent to
deceive a person into viewing obscenity on the Internet shall be fined
under this title or imprisoned not more than 2 years, or both.
- (b) Whoever knowingly uses a misleading domain name with the intent to
deceive a minor into viewing material that is harmful to minors on the
Internet shall be fined under this title or imprisoned
not more than 4 years, or both.
- Potential Actions by Trademark Owners Based on the Typo-Patrol Tool
- Filing multi-domain disputes against registrants of typo-squatting domains
- Tool Usage: use the "Group by Internet Address" view,
expand an IP address node, and "right-click->Whois" on a typo domain to manually
look up the registrant name.
- Run the Reverse-IP tool or http://webhosting.info against those IP addresses that host a large number of typo domains to
discover even more typo domains owned by the same typo-squatters.
- Related Information:
Fined $100,000 Per Domain Name," November 2000
Electronics Boutique Holdings Corp. v. Zuccarini,
U.S. District Court, Eastern District of Pennsylvania, October 30,
- Cybersquatting (or cyberpiracy) "refers to the deliberate, bad-faith, and abusive registration of Internet domain names in violation of the rights of trademark owners."
- $500,000 fine for five domain misspellings: "www.electronicboutique.com," "www.eletronicsboutique.com," "www.electronicbotique.com," "www.ebwold.com," "www.ebworl.com."
Hook-up Sends Typosquatter to Jail," March 1, 2004
Targeted by FTC," 2001
Cybersquatters: New Tools for Trademark Holders," February 2000
- Shields v. Zuccarini, 2001
- Domain name disputes
- Use whois.sc or
Domain Dossier - Investigate domains and IP addresses or
WhoIs lookups to find out who owns a given
- Sending multi-domain takedown notices to ISPs hosting typo-squatting domains
- Filing multi-domain trademark complaints with domain parking services serving ads on typo-squatting domains
- Tool Usage: use "View Top Domains" and
expand a domain parking service node.
- Related Information:
- Other Related News and Links
Target Anti-Virus Vendors," 2005
sued by FTC," 2002
Registration of Domains with Typographical Errors"
Squashes 'Typosquatting'," Associated Press, Jul. 09, 2005
France Wins Typo Squatting Dispute,"
Demys News Service, July 30, 2003
Potter and the Order of the Typo,"
Personal Computer World, Dec. 10, 2004
installed malware by exploiting browser vulnerabilities," April 26, 2005
December 20, 2005
Responds to Significant Cybersquatting Activity in 2005," January 25, 2006
- "Should Owners Of Web Sites Be Anonymous?" By William M. Bulkeley, Wall Street Journal
Online, April 27, 2006
- "Yahoo Sued for Spyware, Typosquatting-Based Ads," Slashdot, May 3, 2006
- "Suit accuses Google of profiting from child porn," CNET News.com, May 5, 2006
These Sites, Their Best Asset Is a Good Name," The Wall Street Journal, May 1, 2006.
- Analysts estimate these types of site, known as "domain parking,"
generate about 5% to 10% of search-engine revenue, putting the industry's annual
revenue at about $600 million. "The profit margins are extraordinary,"
says RBC Capital Markets analyst Jordan Rohan. He predicts industry revenue could
double to $1.2 billion within three years.
- Potential typo domains
- Fiddler HTTP Debugging Proxy
- Dotzup Domain Potential:
Yield per visit, etc.
- Domain Name Wire:
News and Views for the Domain Name Industry
millions of new and deleted domains
Monetization: Allocation Methodology"
- sTypo generates typo domains,
scans them through Overtureï¿½ Search Term Suggestion Tool to get traffic estimates,
and also provides availability and parking information. (sTypo is for domain parkers,
while Strider URL Tracer is for trademark owners who want to catch domain parkers.)
- Third-party domains associated with parked domains
- Typo domains redirecting back to target domains through third parties (April 8, 2006 data)
- Hidden, proxied, N/A, identity-shielded, or privacy-protected WHoIs records (April 8, 2006 data)
- "Whois IDentity Shield, Vancouver, BC, Canada V6C 1A1"
- "Moniker Privacy Services, Pompano Beach, FL 33069"
- "Domains by Proxy, Inc., Scottsdale, Arizona 85260"
- "Whois Privacy Protection Service, Inc., Bellevue, WA 98007"
- "Privacy Protect, Inc, Houston Texas,77079"
- "N/A N/A (Registrar: ENOM, INC.)"
Use the Strider URL Tracer to automatically
and systematically expose third-party web beacons and bugs,
and then seriously ask the following questions:
"What data are you collecting about me?";
"Are you following the privacy rules by giving me
proper notices and choices?";
"Are you safely storing the data and for how long?";
"Who in your company has access to the data?";
"Are you correlating the data with other potentially personally identifiable information without my permission?";
"Are you selling or sharing the data with other companies
without my knowledge?"; etc.
Proper uses of web beacons can improve web sites' ROI and web users' experience;
abusive uses of web beacons may invade user privacy.
Strider URL Tracer brings web beacons to the spotlight,
including all third-party URLs because any of them could be used as a generalized
form of web beacons.
- "Ad firms set rules for Web tracking bugs," CNET News.com, November 26, 2002.
- Use these web sites to find out whether your machine's externally visible IP address is
static and could be used to correlate your browsing activities on multiple web sites:
DomainTools "My IP Information";
In an enterprise environment, if your employees' machines' externally visible IP addresses
are those of your web proxy servers, which can be mapped to your company name,
then web beacons could potentially leak your company's business intelligence
in the form of your employees' collective browsing activities.
web beacons opt-out
- Web Analytics Association
- Redirection domains for some of the most popular web beacons:
- Google-analytics.com (~24,000 URLs)
- Extreme-dm.com (~17,000 URLs)
- Hitbox.com (~15,000 URLs)
- Statcounter.com (~12,000 URLs)
- Sitemeter.com (~11,000 URLs)
- Webtrendslive.com (~9,000 URLs)
- Hitslink.com (~5,000 URLs)
- Addfreestats.com (~4,000 URLs)
- Webstats4u.com or Nedstatbasic.net (~3,000 URLs)
- Coremetrics.com (~2,000 URLs)
- Web-stat.com (~2,000 URLs)