0

Today when I visited drive.google.com, I was auto-directed to http://drive.googe.com/router.php

After clicking on "Exit Now" on that page I was redirected to http://globalreward-zone.sweepclam.eu/home.html

Is this some kind of scam? How to avoid this? I'm running Firefox on Win7.

16

You mistyped the URL:

http://drive.googe.com
http://drive.google.com
                 ^
                There

I confirmed that the redirect to router.php happens when you mistype the URL, and does not happen when you type it correctly.

Note that typosquatting (which is what this is called) is a serious security problem as you no doubt can see. Had the attacker simply showed a Google login, you would have given him your username, password, and possibly 2-factor token.

This is why you NEVER should manually type in a URL to anything remotely important. Use bookmarks or other similar references. And also use a password minder like lastpass, which will not be as easily fooled -- your password won't auto-fill on the wrong site, so you know that if the password doesn't automatically show up, then you're looking at the wrong URL.

  • 1
    I can't believe I didn't doublecheck before posting it here. Thanks. – user13107 Apr 13 '14 at 10:03
  • @user13107 updated answer w/ some add'l security info. – tylerl Apr 13 '14 at 10:04
  • Thanks for tips, also I think there should be a database of such spammy URLs which the browser warns against. – user13107 Apr 13 '14 at 10:07
  • @user13107 Google Chrome does warn you in the case of known malicious and phishing sites. But this is a fingerprinting problem; the signatures change all the time, so your database is never 100% up-to-date. – tylerl Apr 13 '14 at 18:37
  • This also isn't necessarily either malicious or phishing.... unless the site is asking for your password, are they actually doing anything wrong? They are googe.com, and wish to show advertising: it's hardly their fault that you went to their website when you wanted to go somewhere else. (I know, I know, they definitely did it on purpose... but the point is that it's opportunistic, not malicious) – Jon Story Oct 12 '15 at 14:39
-2

Typo Squatting is a form of cybersquatting which is based on the typing errors made by users when they enter a web address in a browser. Typosquatting generally happens with very popular websites which are accessed by a large number of users. This erroneous URLs entered by user may lead them to phishing/malicious/parked websites. Hence this has become an interesting and crucial are of research among security researchers. The article Beware of Typosquatting elaborates more on this and also provides a Python script to check the number and type of typo domains that may result.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.