Bitsquatting

Inside a computer, every letter of a domain name is stored as a byte: eight bits, each a 0 or a 1. The letter l is 01101100. Change the last bit and it reads 01101101, which is m. If that happens to a name sitting in memory, google.com becomes googme.com, and the device asks DNS for that instead.

Bits flip because of memory errors: stray particles from cosmic rays, heat, ageing or faulty chips. Servers usually have error-correcting (ECC) memory that catches most of them. Phones, laptops and many other devices don't. Security researcher Artem Dinaburg showed in 2011 that registering bit-flipped versions of popular domains does attract real requests from devices that hit one of these errors.

Some single-bit flips aren't listed as bit flips in a scan. When the same domain is also a likelier mistake, such as dxample.com, where d is also the key next to e, TypoScan files it under the likelier one.

For a typical website, a bit flip is far less likely than a typo, so these variants come last in a scan. The picture changes for domains that machines contact constantly without a person involved: content delivery networks, API endpoints, software update servers, ad and analytics hosts. Rare errors multiplied by that much traffic add up.

If you run one of those, register the bit-flipped names of your busiest hostnames and point them nowhere, or somewhere you control and log.