Customers of major high-street brands such as Argos, Debenhams, and John Lewis are falling victim to cybercriminals that target mistyped web addresses, a technique known as typosquatting. The poor fumble-fingered shopper ends up with an infected computer and likely losing their personal information.

Record numbers of online sales have already been reported since “Cyber Monday”, and it is estimated that in the UK £3.72bn will be spent online during this holiday season. The allure of the season has also drawn out a surge of cybercriminals.

Researchers at Websense Security Labs have discovered nearly 2,000 typosquatted domains, including: “debenahams”, “johlewis” and “argoss.” The crooks are clever: you normally get to a page that looks just like your favourite retailer. But the site will then lead you to a phishing or other potentially harmful site that injects malware or infects your system with spyware. Some sites are convincing enough to lead people to enter their credit card information.

Similar to typosquatting is when cybercriminals register a variant of a legitimate site with “.org” or “.net”, for example. Back in October, Websense noticed that cybercriminals were registering huge numbers of fake website domains in preparation for the Christmas shopping spree. These web addresses have the brand names spelled correctly, but with the end part replaced, like tescovoucher.org.

Fake sites look like legitimate company websites, luring unsuspecting consumers to enter information, such as when a customer tries to claim online vouchers for high-street retailers. The user is then asked to select another offer shown in a pop-up window. These pop-ups usually host fake competitions offering high value, desirable prizes like the latest iPhone. Users filling in the form inadvertently provide cybercriminals access to their personal information, leading to identity theft, phishing scams, and malware.
Quotes

“Cybercriminals are scary smart at enticing Christmas shoppers to unwanted sites. Whilst this looks like a consumer problem, typosquatting also puts company confidential data at risk as many employees shop from work computers at lunchtime.

Careful typing helps, but will never be enough, so it’s highly recommended that companies install real-time email and web security, along with solutions that prevent theft and loss of confidential information—protection that traditional antivirus and firewall products don’t provide. That way you can stay safe no matter how bad a tyspist yu aree.”