Finding WEIRD Typosquatting Websites

jh.live/flare || You can track down shady sellers, hunt for cybercrime, or manage threat intelligence and your exposed attack surface with Flare! Try a free trial and see what info is out there: jh.live/flare
Free Cybersecurity Education and Ethical Hacking with John Hammond
📧JOIN MY NEWSLETTER ➡ jh.live/email
🙏SUPPORT THE CHANNEL ➡ jh.live/patreon
🤝 SPONSOR THE CHANNEL ➡ jh.live/sponsor
🌎FOLLOW ME EVERYWHERE ➡ jh.live/twitter ↔ jh.live/linkedin ↔ jh.live/discord ↔ jh.live/instagram ↔ jh.live/tiktok
💥 SEND ME MALWARE ➡ jh.live/malware
🔥KZbin ALGORITHM ➡ Like, Comment, & Subscribe!
Music sourced from Artlist.io
Alon Ohana - Parallel Room
Stanley Gurvich - Sunny Days

[@memesfromtheforsakenworlwi9218]

fun facts, most companies buy as much of those "typo domains" to make them redirect to the real site

[@madloudnoises]

Ah, I was wondering why they kept redirecting to the real site. Cool!!

[@Azuuraas]

yup, i know for sure google did that

[@GOOFLEr]

'Most'

[@kuromiLayfe]

still check if you are on the real site.. as the scammers can spoof the address bar and status bar to show the official url (and of course also the titlebar and all links when using inspector). just takes 3ms to replace what is shown the moment the page or hover is activated.

[@BillAnt]

Cuz many type "goggle" when typing fast. lol

[@kalicxingnjenga9657]

Please do a video showing what’s inside that APK.

[@TomJacobW]

hearted - neat! Looking forward to seeing that!

[@IDontModWTFz]

Get APK tool and do it yourself, apks are really easy to re

[@posifurg]

Im going to do a vid showing the APK - ill post it when i can

[@DEZXD1]

The apk says failed to download something

[@adventureman6997]

Yes

[@kyokazuto]

"I think that is the real google", he says looking at google from 10 years ago

[@mordek_original]

interesting

[@Yadobler]

I believe that some devices will result in the old version loading, probably for compatibility

[@kyokazuto]

@@Yadobler I highly doubt that

[@rosenette11]

@@Yadobler You're right, my Vita loads exactly this ver of google

[@aloedg3191]

"I highly doubt that" -🤡​@@kyokazuto

[@AKABeestYT]

I love the typos for regularly nsfw sites that redirect to sites that ask you to repent and fix your ways

[@fruitynyanko7316]

How did you find out about such sites 🤨📸

[@AKABeestYT]

@@fruitynyanko7316 twas simply a passing thought

[@spimbles]

​@@fruitynyanko7316by being a normal human being and watching porn, if i had to take a total shot in the dark

[@dubplater]

@@spimblesthats not normal

[@johanmikkael6903]

​​@@dubplaterI guess cavemen drawing NSFW art back then are also not normal either, but then again, being black in America was considered not normal in the 19th century so the definition of "normal" is kinda relative.

[@bdot02]

Personally like "guthib"

[@szabolcstoth822]

Yap, also my favorite.

[@AverageBlueOFC]

"You spelled it wrong."

[@LennyMiller739]

1373x

[@dinosaurgardening2401]

I know the guy who bought Google with 3 ooo's. He bought it in high-school because he was smart. He isn't a scammer.

[@4rumani]

Yeah very smart lol. Obvious WIPO violation, no legitimate interest, bad faith typosquatting

[@Linkman8912]

​@@4rumanichill

[@justarandomchannel1319]

Bro could prolly sell that for alot tho

[@ihatenerds4689]

​@@4rumaniyou are a sad being

[@Limelaz23]

​@@4rumani y so salty

[@wombatpandaa9774]

Near the beginning I jokingly thought this was going to be an ad segment for Nord VPN but to my pleasant surprise it's an actually really useful FOSS tool. Love to see it.

[@aoihitsu]

Fun fact: my mom used to work in a kids magazine and their website domain looked like a corn site, and bc parents were angry that their kids saw corn by making typos, the mag had to give money to the other site so they would change the name 😂 thats so funny to me

[@Gamerappa]

14:34 google looks like this on certain user agents, it's their old design from 2011-2013

[@ExperiencersInternational]

It was funny seeing Goole as one of the screenshots 😂 Had some fun with pronouncing it when driving past signs for that place on the motorway a few months ago

[@kidnamedfingor]

Just to let u know, when i went on the googie website, there was some illegal content, if i were you i would cut that part out. I went on that domain i wish i could unsee what i saw.

[@jjprisma3d]

It’s really traumatizing.

[@kidnamedfingor]

@@jjprisma3d cant believe he actually let it slip into this video

[@jjprisma3d]

@@kidnamedfingor Atleast he blurred it.

[@jjprisma3d]

@@kidnamedfingor And also, whoever's chid was that. I feel bad for the parents. The person who did that shoud be ashamed.

[@kidnamedfingor]

@@jjprisma3d I translated the Chinese and it said that it was the dad who did it

[@adamn0]

please don’t go to the website at 19:40 i wish i wasn’t curious and went to it i think you should blur out that link or remove that part of the video it’s absolutely disgusting

[@zixea3318]

yeah there’s CP on there 🤢

[@donaldud-deen7604]

Bro whats in there?

[@dan_loeb]

this is one of those things where it's best not to check at all. there is a really messed up image there.

[@tankman5783]

​@@dan_loebman just describe it i dont want the fbi knocking on my door

[@dan_loeb]

@@tankman5783 the site has c.s.a.m. material and should not have made it in to the video period. If you don't know what that means it's often called cp. if you don't know what that means, I'm not going to describe it, as it violates yt policy and should be reported and avoided.

[@Scootakip]

This video really is the meme of "Linux users trying to install a web browser"

[@cybercub4367]

Please do reverse engineer that APK, we're bound to find something juicy there 😂

[@ThinkOrchid]

As an indonesian, im sure that's a site to auto download an online gambling app. Mimics play store, too.

[@ricestrange]

The true video begins somewhere at 13:00

[@giraffeparty0]

thanks I'm not smart enough to understand any of the programming stuff

[@LobsterMobsterTheCrispiestLoaf]

@@giraffeparty0 Unrelated but I love your pfp

[@Fluttergoat]

Isn't a $32/Month virtual server absolutely overpriced and overkill for this? Maybe I just don't know enough about the program or droplets so I'd be curious if there was a genuine reason it had to be that expensive.

[@T1C]

Probably could get by on a $5 vps

[@tbuk8350]

he could've probably done the same thing on oracle always free compute

[@ijucr2267]

Absolutely

[@greenockscatman]

I like the raw realism of the Linux experience at 17:30

[@circuitgamer7759]

I would love to see you doing this more, it's just really fun to watch you have fun with it :) Also looking forward to you looking through those files :)

[@chri-k]

KZbin actually owns the domain youtobe, apparently

[@81gamer81]

you to be, is actually how its meant to bee. Monkey see monkey do. They decide what you see, and what you do

[@FnafAcc-bg9vn]

Oneshot

[@Nakia11798]

Pretty sure they dont, however, own youtub.

[@WebDesignerAmy]

This was a great utility to learn about John! Def found some permutations of some domains I own and those for another creator that came up. ty!

[@knodesec]

14:33 It's an old Google UI :) Thx for the likes 😆

[@kiwipomegranate]

Please make a part two I wanna see more about that "live (ph)fishing game" and the Amazon typosquat hijinks

[@ThisIsJustADrillBit]

Its such a fun rabbit hole watching malicious domains as they are registered. Weird how many of them sre hosted behind cloud flare these days... 🤔

[@chigga5years173]

Why does cloudflare even support them?.. I recently got an sms scam of gettimg rich easily and upon scanning and tryim7to find vulnerabilities of those scammers.. I didn't get anything

[@PazLeBon]

cos cheap hosting is slow :)

[@chrissametrinequartz9389]

or it could also be (for whatever reason) that, thats what they are using to manage their domains or smth

[@papei.taisii]

I have fallen for Agor,io. I wasn't scammed, but traumatised (TW: loud sound + flashing Jeff the Killer image)

[@jiuleender7046]

Oh you just unlocked my childhood trauma

[@purplepeak8575]

Trying this back on Windows 95-Windows XP days is a guaranteed PC destroyer.

[@WALLE1D1W]

Funnily enough, today it's probably safe to do this on the MS-DOS based Windows 9x versions of Windows, as they're too old to be a worthwhile target for malware. All the viruses that you might encounter naturally expect XP and later. At least, according to MattKC's video on the subject.

[@Noctuu]

Loved this video, u should do more “unserious” funny videos, either here or on a secondary channel

[@februalist4686]

WE NEED a continue of this series

[@blakeeey27]

i love the term typosquatting sm

[@cormarcormar]

the phishers are just squattin on that typo

[@bokrayoomjdeed]

loved this thanks JOHN ;)

[@k1ngslay3r41]

lol I never noticed you owned a whole island of dinosaurs that's AWESOME!

[@zixea3318]

Linux users typing the entirety of their computer’s code into the command line just to make a new folder: 🤬🤬🤬

[@thesoftone]

^ this user knows nothing about computers

[@spaghetti5914]

​@@thesoftoneSalty linux user ^

[@thesoftone]

@@spaghetti5914 ^ GIGA cope

[@spaghetti5914]

@@thesoftone This user doesn't know I'm a linux user as well ^

[@Shoegaze-]

Lain pfp hating on Linux… Get off TikTok lol

[@skelkankaos]

Really enjoyed this video because it's a topic that's interesting and you let it be interesting on its own merits instead of overly sensationalizing it

[@uuu12343]

This is genuinely amazing for Typosquat monitoring and intelligence gathering

[@oz_jones]

Youtubs - for all your Jacuzzi needs!

[@iBridgee]

Who knew typosquatting could be so bizarre? 😅

[@shakinspider]

You just committed a federal crime by not blurring out the links to some of these websites

[@half-faust]

Ah, the eternal internet nemesis: people with the same full name as you.

[@nrhowe84]

That is such a cool tool, would love to see a video on what is inside that apk file. Great video keep up the great work that you do.

[@BrimmFate]

Adversaries is a funny way of describing scammer. Like calling them enemies

[@lordvgames]

should do more dnstwist shenanigans, really fun to see what you find

[@CainXVII]

This was great. Would have loved to see some other websites too. And what was actually in that fish file....

[@JohnDoe-bd1qe]

Now I see the true meaning of the minor spelling mistake meme.

[@aidi4886]

I choose you John. Make me smart!!!

[@bokrayoomjdeed]

Hilarious maaan daamn! nice video bro really thanks.

[@mattnaylor29]

There is a bank in the uk called first direct. My 80+ year old family went to fist direct, it was a fisting porn site.

[@dannydetonator]

As someone not well versed in IT, coding and html, i just learned a bunch of new words here. Typosquatting just made me think of my poor-ass unaccomodated seasonal-worker (initially) eurotrip.

[@murphy2269]

i have no idea what you're talking about but i love this video

[@rocket01666]

Crack open that APK next PLEASE!

[@EVENCOOLERTHANJOHN]

F I S H I N G L I V E G A M E . A P K ( 2 0 )

[@DerMarkus1982]

Let's see if Jason will feature John Hammond in a clip compilation soon 😁

[@milentiusgaming]

looking forward to THE video of the breakdown of the APK, maybe there was more to the "nothing" in the empty text file....

[@yewo.m]

This gave me "hacking in movies" vibes

[@reviathan3524]

I remembered back then if you type blogspot without the s, it'll redirect to a site showing a "secret new world order plan"

[@ownmicelio]

Please do a part 2

[@abdoudicko5352]

You are the best

[@thesoftone]

kinda makes me want to try live booting Kali maybe, cool vid

[@malka1762]

gotta hand it to the fishing "devs", they're kinda transparent when you think abt it 😂

[@Jarkabob]

I tried that one time and got a virus 😭

[@sucra0710]

Dnstwist it, bop it, pull it

[@scykol]

domain expansion: typo

[@user-cd4bx6uq1y]

16:59 that's master Rama isn't it? The cult Edit: 19:41 amazing reaction

[@monkepog3236]

theres even illegal content on it, jail for at least 30 years for hosting it

[@joebambanchannel]

The best,👍

[@lancemarchetti8673]

Brilliant

[@AmCanTech]

The site that redirects to aliexpress is likely a 3rd party that outputs their affiliate link so they earn a commission... even if you dint shop via that link directly, a refer cookie is likely stored such that if you end up shopping within X amount of time they get credit for the sale.

[@giraffeparty0]

their affiliate WHAT??? ik u meant link but thats an unfortunate typo lol

[@Ilikeflowers22]

Unrelated, but i really like your hair :)

[@ErichSchulz]

It seems to have a domain name size limit when using the web interface.

[@pavi013]

I usually bookmark all the sites i visit daily, but obviously mistakes can happen.

[@oussemabenayech2345]

every jhon hammond should get into a fight and see who will earn the name

[@PazLeBon]

not a fight, even a dummy can win a fight

[@iwasneverjoebiden]

good video

[@pollywops9242]

Super useful tool

[@MFoster392]

Very Cool :)

[@rob-890]

He's doing the thing where he repeats synonyms over and over again 😂😂😂😂

[@purplesam2609]

I wanted to go to the SpongeBob website as an 8 year old kid on my grandma's laptop and I found a site with a photo of some random man with a typo

[@Sabagegah]

Fishing - Live Game

[@Ramonatho]

Wait. Hang on. I noticed something about that slots game with the automatic download. On the section that says "The New One" it mentions Bob Slots, a youtube channel I watch, who has never promoted this app. That means they're scraping ultra specific small slots youtubers and saying they're promoting their game. Bob isn't a big channel. This is truly weird stuff.

[@abdelhay.]

WE WANT MOOORE OF MALWARE ANALYSIS VIDEOS PLEASE.

[@scrungles7853]

I have no idea what you're talking about, nice!

[@maskstorm1]

Same here

[@iwasneverjoebiden]

Same here but I love it

[@cherno6592]

that fishing live game is advertising as that one gambling game or application, it on Indonesian language

[@Nooner301]

a little help, the live fishing page is in Indonesian, prolly trying to steal info or malware due to how many people use gambling / slot sites and apps here. 1jt is 1 million, reffering to downloads

[@YTInnovativeSolution]

Daily Dose of Internet is one of the best channels ever made. Thanks for your daily dose Mr. H.

[@mattsadventureswithart5764]

Based on the one guy I met with that first name, its pronounced "Mar cheen" with the "mar" being the same as "mark" without the k, and "cheen" being the same as "cheese", with an n instead of the z sound.

[@The_hot_blue_fire_guy]

Is there a program like that website detecting thing for people who use normal operating system like windows or Mac OS and not those hacker OSs like Linux. You know, normal software for normal people that actually exist in the real world.

[@Nitroband]

I hope you were running a VPN, your IP Address got dropped by one of those pages.

[@wombatpandaa9774]

I'm pretty sure that was the digital ocean ip and not his host

[@Nitroband]

@wombatpandaa9774 Okay, that's good then!

[@megafoxatron3rd521]

the guy can't figure that google is one of the top searches without doing a google search

[@iesx_imchocomint]

The 19:40 website is now safe to go to. It now redirects to a gambling site.

[@junebryant-ki1ir]

it 404's

[@doyouknowkeplertwentytwob4032]

holy shit it’s alex yiik

[@Qw3rtyLly]

Goop gle dev is a jokester lol

[@stefanjohansson2373]

16:50 Never seen this?!

[@soloriyeovin5011]

very fun

[@foundmedia]

hey man, i'm going to repeat what a few other commenters said, you should edit this video to remove that one "weird" website because showing the link is technically distribution of cp. NOT visiting the website myself, just relaying what other commenters saw when they visited the site out of curiousity, maybe you didn't even realize what you were looking at because you laughed it off so easily in this video.

[@Noughtsgnik]

how do you know if it's cp or not

[@venerablepoof]

Why would you risk it?

[@BoinkySponge196]

There’s actually a really funny kinda(??) typosquatting website that’s literally videos of corn being cooked with weird names

[@avery581]

CornHub?

[@itloaf]

ah yes, the corn hub classic

[@v.adithya1768]

Hi, When i run the --phash command, I get this error even though selenium is already present in /usr/lib/python3/dist-packages dnstwist: error: missing Selenium Webdriver

[@PegasusEpsilon]

"sudo" is short for "do as superuser" - "sue due", not "sue dough" - sudo is not a martial art.

[@torrtoise]

alternative title: linux working as intended

[@gurukuappannadora8982]

Excellent stuff but we are missing actually what you are explaining kindly explain your experience in slow motion I feel it something like something that computation is going here

[@powmod]

13:50 I would guess they are redirect domains. Google owns a lot of its homonyms.

[@SilentOnion]

14:33 is not really "strange" google its just the old design from like the late 2000s.

[@UltimatePerfection]

Marcin is (roughly) pronounced as Martzin.

[@harrylumsdon6773]

Chrome and edge has the safe search option??

[@liviaw]

That Fishing Live Game is probably targeted and/or made by Indonesians. “1jt” means “1 million”. Just thought I’d share this

[@VaibhavShewale]

well moost of them showing old version and some just ads all over the page