In October 2019, Digital Shadows (now ReliaQuest)’ Photon Research Team embarked on an adventure involving election typosquats that could potentially affect the presidential election and its candidates. If you haven’t read our original report, I’ll fill you in on a brief recap:
We detected over 550 typosquats for the 34 candidate- and election-related domains from open-source research. Not every single domain was interesting; most of the time, the typosquat was parked and not hosting content. Still, there were some worthwhile areas to dig into deeper: Misconfigured or illegitimate sites, non-malicious sites, and website redirects.
When monitoring for specific domains that impersonate our clients’ brand or are capable of potentially misleading client employees or their respective clients, we see it as an issue to which they should be alerted. When it comes to these domains affecting the general voting public, the same concern is present: Are people tricked into entering their personally identifiable information or sensitive details, is their device infected with malware, are the domains redirecting to an across-the-aisle candidate’s website, or are they redirected to potentially misleading information?
In terms of social sway, these domains are unlikely to highly affect a voter’s individual opinion, but still, typosquats can aid in confusion and misinformation.
Let’s take a look at our most updated election-related typosquat data and findings.
Preparing the podium.
No, I’m not really going to speak to you from a podium, but before we get into the meat and potatoes of this blog, I want to highlight why we’re writing about this, what we searched for, where we got our data from, and what we did with it.
Initially, we were planning to post a blog like this later in the year, when we got closer to the election. Then we began researching the recent bulletin by the Department of Homeland Security (DHS), which warned Internet users of potentially malicious domains related to the United States election. Since our research seemed to be relevant to current reporting, we figured it may be beneficial to update our data to see if the landscape has changed.
Digital Shadows (now ReliaQuest) used Shadow Search to identify domains that included the following text within their WHOIS data:
- Trump
- Pence
- Biden
- Kamala OR Kamala Harris
- Vote
- Elect
- Poll
After collecting our data, we scrubbed through and identified the true positives by gauging the likelihood of the domains being candidate- or election-related. We ended up with 225 potentially malicious domains – exactly half of the sample we used in October. Considering the primary Republican and Democratic party candidates are identified at this point, it makes sense that our sample size is smaller than it was when we first began this journey.
Okay, everyone’s primed, and we’re on the same page. Here’s what we found.
Are we fighting a fake domain campaign?
While we can’t confirm who is setting up these websites and why they’re doing it, it has become clear that domain squatting has become a popular method among threat actors and zealous voters alike.
Just as we classified our data in our first election typosquatting blog, we decided to classify the different types of typosquats we detected into three distinct categories, which are replete with examples:
- Misconfigured or illegitimate sites: Typosquats that were not correctly configured when initially created and aren’t hosting anything but an index page, as well as typosquats that likely are not legitimate but look like they could be
- Non-malicious: By far the largest category we detected, mainly consisting of typosquatted domains that are either not hosting content or are hosting content that includes a small amount of brand-damaging content
- Redirect: Typosquats that redirect the user to a different website
The following chart shows the breakdown of relevant typosquatted sites we uncovered, by category.
Non-malicious sites have a 67% majority.
Digital Shadows (now ReliaQuest) found that 67% of the 225 sites related to presidential candidates or the election were non-malicious. Compared to an 8% minority in 2019, that’s good news, right? Well, kind of. Most of the non-malicious sites that we detected were parked domains, which can act as a false sense of safety; sure, it’s not hosting right now, but that can change within an instant and without warning. Additionally, if a parked domain has an MX (Mail eXchange) record, it could potentially be leveraged in a phishing campaign, which we know is bad news all around.
As we said, many of the non-malicious domains were parked, but some showed negative sentiment. This is slightly more on the brand-damaging side of things. For example, biden2020[.]com displayed anti-Biden content, specifically underlining, “the dangers of voting for Biden.”
Another website we came across, donaldtrumpjr[.]net, didn’t directly involve a presidential candidate in the domain name; however, its contents could negatively affect Donald Trump’s brand.
Illegitimate sites can still affect your brand.
We assessed that 21% of our sample data involved illegitimate or misconfigured sites, increasing from 2019’s 8%. While many of the domains we identified were associated with DNS errors, others seemed to be hosting websites that weren’t malicious in nature, but probably weren’t created by a presidential candidate’s team. An example is listed below – the sentiment of the site appears to be neutral, but it’s highly unlikely that Joe Biden’s team set up mamalaharris[.]com.
Similarly, don-trump2020[.]com doesn’t appear to be owned and operated by Donald Trump’s campaign, and it doesn’t look malicious in nature, either. If I were to guess, I’d think that this page was created by a fan of the candidate, looking to spread their message by selling some pro-Trump merchandise.
Typosquat redirects have a 12% minority.
Redirecting domains accounted for 12% of our sample data during this round of analysis, compared to 68% in 2019. The redirecting domains that we found included a “healthy” mix of brand protection and negative sentiment.
Some domains appeared to be leveraged to redirect to legitimate sites, including bidenharrislive[.]com and presidentjoebiden[.]live, which resolved to joebiden[.]com. This method is a form of brand protection; many site owners choose to buy similar domains so other users can’t use them to mislead visitors or impersonate their brand (we’ll touch more on this later). Other sites, such as trump-is-bad-for-us[.]com and biden[.]exposed (unsurprisingly) redirected to content disagreeing with the candidates, respectively.
![biden[.] exposed](https://wpblog2022dev.wpengine.com/wp-content/uploads/2020/09/biden-exposed.png)
A few instances of redirects resolved to legitimate presidential candidate websites, but probably not the candidate a user intended to support or read about. For example, biden4freedom[.]com redirected to Jo Jorgensen’s page, jo20.com, while another domain, ceosagainsttrump[.]com, redirected to Joe Biden’s page. Tricky, tricky!
Shady Chrome extensions
Redirection can come in different varieties, including the shady kind. We found one typosquatted domain that redirected to a “secure browsing” Google Chrome extension – trump-donald[.]com.
The domain eventually resolved to Donald Trump’s dedicated Wiki page. Occasionally, bad actors will lure users into downloading Chrome extensions, and they’re rarely legitimate. In June 2020, Google removed 106 Chrome extensions for collecting sensitive user data.
What I’m really trying to say here is be critical, and if nothing else, make sure you’re only using extensions you need.
A note on election and voting websites.
As we get closer to the election, it’s highly likely that malicious actors will register and leverage election and voting websites to mislead users. We identified 47 potentially malicious domains that were either parked, redirected to a different website, or were illegitimate or misconfigured. For example, register2vote2020[.]com and register2vote2020[.]net, are not currently hosting content; however, the potential for these sites to gather sensitive voter details is something to consider, especially as we’re approaching the cutoff for 2020 voter registration.
Another site, real2020poll[.]com, does not appear to be malicious in nature, but I think it’s safe to say that it’s probably not operated by a legitimate United States polling organization.
Stay safe out there, Voters.
In times where disinformation, manipulation, and shady websites are at an all-time high, users must remain vigilant. Are you sure that the website you’re visiting is legitimate? Do you really need to download that Chrome extension? Are your sensitive details being submitted to a legitimate database? These are all things to seriously consider while surfing the web.
To keep yourself safe, we recommend that you corroborate the website’s legitimacy by looking at the candidate’s social media networks. Typically, candidates will share their official domains in their biography sections or highlighted within their feed―if you’re looking to donate to one of the campaigns, try looking there first for information. We don’t recommend visiting linked websites sent via unsolicited emails, as this is a common tactic of threat actors employing phishing pages.
From an organizational point of view, here are our recommendations on avoiding possible brand impersonation or damage:
- Buy Domains Similar To Yours. For practitioners, if we look at typosquats in a timeline, one of the initial things you can do is buy domains that appear to be similar to yours. Obvious options would be domains that are one or two letters off from your legitimate domains. Using a tool like DNSTwister, you can generate a list of currently active domains that could already be impersonating your brand or give ideas for where to start purchasing domains.
- Monitor Domain Registration Activity. You should also start monitoring registration activity. This is hard enough for one domain, but if you have several it may be a bit unmanageable. At that stage we would suggest getting help; part of our core service at Digital Shadows (now ReliaQuest) is monitoring for domain impersonations and providing a variety of alerts: when a new typosquatted domain is available to register, when someone has added an MX record that is required to send emails (read: PHISHING emails), when a domain is actively hosting impersonating content, and more.
To learn more about typosquat and phishing protection, check out our Phishing Protection resources center page.
Researched domains
| Domain | Behavior |
|---|---|
| joe-biden.com | Misconfigured or illegitimate |
| joe-biden.com | Non-malicious |
| joe-biden2020.net | Non-malicious |
| bw2020.org | Non-malicious |
| joe46biden.com | Non-malicious |
| joe-biden-kamala-harris.com | Non-malicious |
| joe-biden46.com | Non-malicious |
| joe-biden-for-president.com | Non-malicious |
| barack-obama-and-joe-biden.com | Non-malicious |
| bidenwarren2020ticket.com | Non-malicious |
| imjoebiden.com | Non-malicious |
| biden-klobuchar-2020.com | Misconfigured or illegitimate |
| biden2020faceshield.com | Non-malicious |
| biden2020.com | Non-malicious |
| biden2020usa.com | Non-malicious |
| biden2020s.com | Non-malicious |
| joe-biden2020.net | Non-malicious |
| biden2020coin.com | Misconfigured or illegitimate |
| biden-obama-2020.com | Non-malicious |
| biden-sanders2020.com | Non-malicious |
| harris-biden2020.com | Non-malicious |
| biden-potus2020.com | Misconfigured or illegitimate |
| biden2020ppe.com | Redirect |
| biden4prez2020.com | Non-malicious |
| biden2020signs.com | Non-malicious |
| biden-winfrey2020.com | Non-malicious |
| biden2020flags.com | Non-malicious |
| biden2020shirts.com | Non-malicious |
| 2020biden.com | Misconfigured or illegitimate |
| biden2020win.com | Non-malicious |
| biden2020shirt.com | Misconfigured or illegitimate |
| joseph-biden2020.com | Non-malicious |
| biden-harris2020.net | Non-malicious |
| Nextgendems4biden.com | Misconfigured or illegitimate |
| biden-orourke2020.com | Non-malicious |
| biden2020shirts.net | Misconfigured or illegitimate |
| biden-buttigieg-2020.com | Non-malicious |
| biden2020masks.com | Non-malicious |
| trump-biden2020.com | Non-malicious |
| biden-warren2020.com | Non-malicious |
| bw2020.org | Non-malicious |
| innovators4biden2020.com | Misconfigured or illegitimate |
| dogs4biden.com | Non-malicious |
| outforbiden.org | Non-malicious |
| biden4freedom.com | Redirect |
| sayno2biden.com | Non-malicious |
| biden4muslims.com | Non-malicious |
| smes4biden.com | Non-malicious |
| independententrepreneurs4biden.com | Non-malicious |
| entrepreneurs4biden.com | Non-malicious |
| nextgendems4biden.com | Misconfigured or illegitimate |
| joe-biden-kamala-harris.com | Non-malicious |
| kamala-harris2020.com | Misconfigured or illegitimate |
| kamala-harris2020.net | Misconfigured or illegitimate |
| BIDEN2020ONLINESTORE.COM | Non-malicious |
| biden-harrismerchandise.com | Non-malicious |
| biden.exposed | Redirect |
| biden-harris-election.com | Non-malicious |
| biden.sexy | Redirect |
| biden.icu | Redirect |
| biden.monster | Non-malicious |
| kamala.club | Non-malicious |
| joe-and-kamala.com | Non-malicious |
| kammalaharris.com | Non-malicious |
| mamalaharris.com | Misconfigured or illegitimate |
| kamalaaharris.com | Non-malicious |
| kamallaharris.com | Non-malicious |
| kamalharris.com | Non-malicious |
| kampalaharris.com | Non-malicious |
| kamulaharris.com | Redirect |
| kamelaharris.com | Redirect |
| kamalaharriss.com | Redirect |
| kamalaharis.com | Non-malicious |
| kamala-harris.com | Redirect |
| kamlaharris.com | Non-malicious |
| joe-hiden.com | Non-malicious |
| joe-bidden.com | Misconfigured or illegitimate |
| joe-bidens.com | Non-malicious |
| biden-harris-team.com | Redirect |
| harris-biden.net | Non-malicious |
| biden-harris-20.com | Non-malicious |
| biden-harris-ticket.com | Non-malicious |
| joe-biden2020.com | Non-malicious |
| biden-brindisi2020.com | Non-malicious |
| biden-harris-2024.net | Misconfigured or illegitimate |
| biden-harris2024.com | Non-malicious |
| biden-harris-2020.net | Misconfigured or illegitimate |
| 2020biden-harris.com | Redirect |
| biden-harris.com | Non-malicious |
| joe-and-kamala.com | Non-malicious |
| joe-kamala.net | Non-malicious |
| bidenharrislive.com | Redirect |
| vicepresidentkamalaharrislive.com | Redirect |
| presidentjoebidenlive.com | Redirect |
| vicepresidentharrislive.com | Redirect |
| vicepresidentkamalaharris.live | Redirect |
| presidentjoebiden.live | Redirect |
| vicepresidentharris.live | Redirect |
| biden2020clothes.com | Misconfigured or illegitimate |
| biden.design | Non-malicious |
| biden.holdings | Non-malicious |
| biden.gallery | Non-malicious |
| biden.llc | Non-malicious |
| biden.miami | Non-malicious |
| biden.ninja | Non-malicious |
| biden.camp | Non-malicious |
| biden.school | Non-malicious |
| biden.cyou | Non-malicious |
| vets4biden.com | Non-malicious |
| biden-harrisbus.com | Non-malicious |
| biden.tube | Non-malicious |
| ok-biden.com | Non-malicious |
| nursesforbiden.org | Misconfigured or illegitimate |
| elect-biden2020.com | Redirect |
| kamala-biden2020.com | Redirect |
| vote4harris.com | Non-malicious |
| harris2024.vote | Non-malicious |
| bidenharristicket2020election.com | Non-malicious |
| byedon2020.vote | Non-malicious |
| byedon.vote | Non-malicious |
| the-donald-trump.com | Non-malicious |
| beardsfortrump.us | Misconfigured or illegitimate |
| trump-gop-retreat-got-real-donald-trump.com | Misconfigured or illegitimate |
| therealdonaldrtump.info | Misconfigured or illegitimate |
| donald-trump.website | Non-malicious |
| president-donald-trump.site | Misconfigured or illegitimate |
| president-donald-trump.website | Misconfigured or illegitimate |
| donald-j-trump.love | Misconfigured or illegitimate |
| donald-trump-wtf.site | Misconfigured or illegitimate |
| donald-j-trump.com | Non-malicious |
| trump-donald.com | Redirect |
| donald-trump45.com | Non-malicious |
| donald666trump.com | Non-malicious |
| donaldjoketrump.us | Non-malicious |
| magasec.us | Misconfigured or illegitimate |
| donaldtrumpjr.net | Non-malicious |
| donald-trump-tweets.blog | Misconfigured or illegitimate |
| donald-trump-us-president.info | Misconfigured or illegitimate |
| donald-j-trump-presidential-library.net | Non-malicious |
| trump-tight.online | Non-malicious |
| trump.consulting | Non-malicious |
| trump2020trainwhistle.com | Non-malicious |
| trump2020thegobconvention.com | Misconfigured or illegitimate |
| trump-is-bad-for-us.com | Redirect |
| trump4thepeople.com | Non-malicious |
| latam4trump | Redirect |
| serbs4trump.com | Non-malicious |
| don-trump2020.com | Misconfigured or illegitimate |
| trump2020promos.com | Non-malicious |
| reelect-trump-pence.com | Non-malicious |
| trump-ees.com | Non-malicious |
| alt-trump.com | Non-malicious |
| trump-pence-maga.com | Non-malicious |
| trump2020fanclub.com | Non-malicious |
| trump.associates | Non-malicious |
| ceosagainsttrump.com | Redirect |
| trumpaccountability.org | Non-malicious |
| trump-19virus.com | Non-malicious |
| trump-keep-america-great-2020.com | Non-malicious |
| cowboys4trump.com | Misconfigured or illegitimate |
| trump4u2020shop.com | Misconfigured or illegitimate |
| trump2020payperview.com | Non-malicious |
| trump.how | Misconfigured or illegitimate |
| trump20hat.com | Non-malicious |
| trump.football | Non-malicious |
| trump2020co.com | Non-malicious |
| trump–2020.com | Non-malicious |
| trump2020supportmerch.com | Non-malicious |
| trump-right.com | Non-malicious |
| yo-trump.com | Non-malicious |
| trump.bargains | Non-malicious |
| trump2020merch.net | Non-malicious |
| trump-stuff.com | Non-malicious |
| putin-pence.com | Non-malicious |
| pence.cm | Non-malicious |
| trumpforgetsvets.org | Misconfigured or illegitimate |
| maga-election.com | Non-malicious |
| potus.review | Misconfigured or illegitimate |
| america2020election.com | Non-malicious |
| america-2020-election.com | Non-malicious |
| electionsecurity.us | Redirect |
| webex.vote | Non-malicious |
| oakland.vote | Non-malicious |
| progressivevote.us | Non-malicious |
| progressive.vote | Non-malicious |
| vote.center | Non-malicious |
| directionsto.vote | Non-malicious |
| activate.vote | Non-malicious |
| ballottracker.vote | Redirect |
| nvregistration.vote | Redirect |
| sendit.vote | Non-malicious |
| vote4better.org | Non-malicious |
| vote4better.com | Non-malicious |
| womenvoteflorida.vote | Non-malicious |
| workthepolls.us | Non-malicious |
| usps.vote | Non-malicious |
| lets-go-vote.com | Misconfigured or illegitimate |
| howcani.vote | Misconfigured or illegitimate |
| weneedyou.vote | Misconfigured or illegitimate |
| countmein2020.vote | Non-malicious |
| electorate.vote | Non-malicious |
| elector.vote | Non-malicious |
| vote2saveamerica.com | Non-malicious |
| moderateamerica.vote | Non-malicious |
| vote.today | Non-malicious |
| texaswomen.vote | Non-malicious |
| miami.vote | Redirect |
| the2020.vote | Non-malicious |
| unitedwe.vote | Non-malicious |
| was-my-vote-counted.com | Misconfigured or illegitimate |
| ellectoral-vote.com | Misconfigured or illegitimate |
| vote1proud.com | Misconfigured or illegitimate |
| postyour.vote | Misconfigured or illegitimate |
| forum.vote | Misconfigured or illegitimate |
| millennial-vote.com | Misconfigured or illegitimate |
| real2020poll.com | Misconfigured or illegitimate |
| nc-poll.com | Misconfigured or illegitimate |
| 24-7poll.com | Non-malicious |
| register2vote2020.net | Non-malicious |
| register2vote2020.com | Non-malicious |
| web-election.com | Non-malicious |
| election-vote.com | Non-malicious |
| election2020masks.com | Non-malicious |
| electionworkercorps.org | Non-malicious |