FAQ version: 3.0 dated 25 August, 2020.
The "Typosquatting data feed" captures at least 3-member groups DNS domains so that
Appearance on the same day in the zone file normally means that the domains were registered on the same day, close to the given date. By "similar to each other" we mean similarity with respect to a suitably chosen algorithmically calculable mathematical characterization.
The coverage of the search for such a domain by the data generator is the set of domains in the top- level domains covered by the following daily data feeds:
This set covers almost all generic top-level domains and a number of country-code top-level domains.
Important disclaimer: a domain listed in this feed is not necessarily malicious or related to any dangerous activity. Nevertheless, it is a fact that if a domain is listed:
The possible reasons for a malicious domain to appear in this feed include:
The possible reasons for a benign domain appearing in the feed include:
The data feeds hold domains which are, though possible benign, prone to typosquatting or phishing attacks and malware-related activity. Therefore it is recommended to doubly check them when used for any purpose (e.g. opening in a web browser) to maintain cybersecurity.
The listing can also be useful in studying manually or algorithmically with various purposes:
Consult our blogs at the product webpage for further details.