3

I have my new website to be published (it's called buysteel.com). I will have thousands of clients visiting my site every month, and I would like to protect them around and at the site. Is it worth buying nonsense domains that just have the function to redirect them to the right domain?

For example I could buy these domains also:

  • buyssteel.com
  • buyysteel.com
  • buysteeel.com
Improve this question
3
  • Is this a security question? What security angle are you seeing? You didn't include any threat scenario.
    – schroeder ♦
    Sep 2, 2019 at 16:55
  • There is a reason large corporations buy many, many domains to prevent typosquatting. Much of this is security based, unlike what Vipul says.
    – Rory Alsop ♦
    Sep 2, 2019 at 18:40
  • 1
    Perhaps add buysteal.com to that list?
    – TripeHound
    Sep 4, 2019 at 9:16

4 Answers 4

Reset to default
5

Only you can decide whether or not it's worth it. There are a few situations that you should consider:

  1. How does your typical user visits your site? Are they primarily visiting because you gave them physical business cards or adverts where they have to type your domain manually? Then you should register and redirect all common typo domains to your main domain. Are your users primarily visiting you from online adverts or search engine? Then you probably don't need to worry much about typo domains.

  2. Are you aware of overseas businesses in similar industry that have similar sounding names that might one day expand to your country? Then you might want to consider purchasing their domain name to protect your own trademark.

  3. Are you using a country specific TLD? Are you not on the .com.xx of your country's TLD? Are your main domain on a novelty TLD? Then you might want to consider purchasing the .com version of that domain name, in case you have users that thinks that every website ends with .com, or if they tried to use Ctrl+Enter on the URL bar.

  4. Are there other countries that your business might plan to expand to in the near future? Then buying your name under that country's TLD might be something you might want to consider.

  5. Does your main domain names consist of common, regular words in the language in your primary audience? Is there common, similar sounding/similarly typed words or synonyms that your audience might misremember your name as? Does your name consist of unusual words?

One thing you definitely want to do to set a budget limit on your domain purchases. The number of you would have to have for this kind of typosquatting are endless. There are endless variety of permutations and you cannot purchase every single permutation of typos and similar names unless you have endless budget, which I assume you don't. So you'll need to set priority of what matters to you most. Domain names aren't that expensive, but they do cost quite a bit, and you need to renew them every year or so. If you're a smaller business, holding 500 typo domains are going to eat into a good chunk of your revenue. If you are Google, these expenses are negligible.

How much are you willing to spend to hold an asset that don't actually make you any money, for a situation that probably won't matter much even if it happens. Do you have other ways you could better spend the money? That $100/year you spend on squatting might be better spent on upgrading to a higher tier server or to buy a CDN service to help improve that performance issue that you've been having.

Improve this answer
1

Is it worth buying nonsense domains that just have the function to redirect them to the right domain?

From a security perspective NO! From a business perspective, that if a client visits a wrong website and you lose a potential sale? Maybe, it might be a good idea.

Why is the idea not very good one from a security perspective?

  1. I am going to go out and say that you won't be a victim of such an attack if your site is just starting out. An attacker would most likely try this attack in a site which has far more users.
  2. If you are going to implement the idea there would be quite a few permutation of domains you will have to buy out for the purpose, and even when you do that there will always be a combination that an attacker would use.
  3. You could also look at point 2 from an attacker's perspective what permutation would he buy out and how would he even come to the conclusion that he must buy out certain domain where people are bound to make mistakes, at the end it's just not a very good approach. Sure it might be good enough for an obvious mistake such as gooogle.com.
  4. In the end, doing this will only have minimal effect on overall security.

In the end, it might boil down to your opinion, but personally, I think the idea is not worth investing into.

Improve this answer
9
  • So you're saying that if you had say 20 permutations, it's not worth the $200, and an hour of your time? The payoffs in security aren't immense, but the costs are ridiculously low.
    – Steve Sether
    Sep 3, 2019 at 14:49
  • 2
    @SteveSether Not everyone is from place where they use dollars.200$ in my country is quite a lot and some domains can be very costly.Apart from that the top voted explains it well enough.It really comes down to cost and security.In my opinion its not worth investing in for a website that is about to be published.If you have some resources/articles/papers that goes in detail about how big the attack surface is please comment it,i would love to read it
    – yeah_well
    Sep 3, 2019 at 16:43
  • That may be the case, but for most of the IT world, $200 is peanuts. Even in India this ads up to about 7 hours of developer time.
    – Steve Sether
    Sep 3, 2019 at 19:47
  • @SteveSether i am from india on average a developer would make around 30thousand a month,and i am being generous there so he would make 400$ a month.I dont know where you came up with 200$ for 7 hour work,cause we work 9-5
    – yeah_well
    Sep 3, 2019 at 20:05
  • I had no idea it was that low. In any case, the fact remains that for the vast majority of people who develop websites, $200 is nothing. Advertised rates for outsourced developers here range from $12 to $50 an hour. So from a costing perspective, that's still nothing. Here, I can't hire someone from India and pay them $400 for a months work, so the pay rate the developer gets doesn't really matter.
    – Steve Sether
    Sep 3, 2019 at 20:28
1

It is a security concern, for they could be used for phishing attacks or domain fronting for C2 servers. You should 100% buy out all of the yourdomainname.com/eu/xyz/site/... etc.

Now that being said, if we are looking at name similarities, it really depends on are you willing to accept that risk, if we are talking about Small Business and you are not expecting massive traffic to your website, it's probably not worth it.

If we are looking at an enterprise business than it's worth considering doing that.

Improve this answer
0

yes, as they do not cost much, why not. Have you been to gooogle.com lately?

But posting this here might be the reason the domains are gone before you have the chance to buy them...

Improve this answer
1
  • 3
    The way the question is phrased, it seems fine to me.
    – schroeder ♦
    Sep 2, 2019 at 16:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .