24

I have recently joined a non-IT department of a large (>10,000 employee), say called "Kirby Matthews". Their main domain is kirbymatthews.com, but I received an internal email which had a link to "surveyresponse@kribymatthews.com .

The link in the email was a fairly subtle typo that I suspect is obvious, out of curiosity I checked the domain and saw it wasn't registered.

I strongly suspect if I flag this as an IT issue it will just get lost in noise of the large company. Nonetheless, I could register it anyway and just setup a general redirect and auto-response to emails saying it was the wrong person.

It obviously could be a cyber security risk going unregistered or otherwise given its similarity, so it would be beneficial for the company to hold and I'd gladly give it to them if asked.

What should I do?

Update:

Following the answer by franklylately I flagged it as a data breach (closest category I found in the it ticket system). After 2 weeks the ticket was closed without any further comment, but closed on the same day the typo domain was registered. Therefore, I take it that they acted on the ticket.

5
  • 1
    Comments are not for extended discussion; this conversation has been moved to chat.
    – Kilisi
    Oct 11, 2022 at 3:00
  • 9
    Are you sure it was a mistake? In-house security awareness campaigns often use this sort of thing to see who reacts, when an email with suspicious, but more or less correct looking links is sent around. That the domain isn't actually registered doesn't matter. There are multiple ways (proxy-logging, firewall-logging, splunk, just to name a few examples) of detecting to determine if anyone falls for it.
    – Tonny
    Oct 11, 2022 at 11:28
  • Do you have the authority to purchase a domain on the company's behalf? Oct 11, 2022 at 22:45
  • @Tonny,. Yep defo a mistake. While not in IT myself I am in a technology division and know that this was just a typo in a company social life email..
    – EdL
    Oct 13, 2022 at 6:08
  • @MattTimmermans, I don't have that authority, I am just an everyday employee in another dept.
    – EdL
    Oct 13, 2022 at 6:08

11 Answers 11

29

This is more of cybersecurity team issue. Depending on the information your company deals with,(eg financial or healthcare) it may be worth security team’s effort to prevent phishing attempts from unclaimed domains. From my experience, my company owns a lot of transposition domains — we are dealing with active cybersecurity threats.

With that said flag it with your teams or ask your manager who the appropriate team to flag it to is — do not spend your money to cover issues your company owns.

104

Flag it up to them and then forget about it.

There are a huge number of slightly different variants of a domain (think about how many two letter swaps there could be, plus all the other typos and mispellings). And that's before you even get into TLDs (such as kirbymatthews.net, or typo TLDs like kirbymatthews.cm) - especially with all the new TLDs that IANA have launched.

Trying to buy up every domain that looks similar to yours just isn't practical. The company might decide to try and monitor them (using free tools like dnstwist), or hire a third party to keep on top of them and try and send legal threats against people who register. But in reality most companies don't really care enough to do anything, as they have limited time and resources, and more important issues to worry about.

Registering this domain yourself is generally not a good idea - at best your spending your own money to "protect" your company, but at worst it could be seen as you trying to intercept emails intended to the company, or create all kinds of issues once you leave (and still own the domain).

3
  • " try and send legal threats against people who register" I suspect this isn't legal. Owning a domain doesn't give you any rights whatsoever to "close matches". Multiple companies with the same name in different areas will certainly end up sharing very similar domains (see nissan.com). Sending legal threats just for registering a domain is wrong & expensive for no value. What you should do is keep track of similar domain registered, and monitor if they host something and when they do check if the hosted content is a phishing site or some form of trademark violation and only on these cases.
    – GACy20
    Oct 10, 2022 at 9:53
  • 8
    @GACy20 it will depend on whether the name is trademarked, and which jurisdiction you're in. But even if a large company can't win a court case, most individuals (or small businesses) probably can't afford to fight them in court - so it doesn't really matter whether they're right on wrong.
    – Gh0stFish
    Oct 10, 2022 at 11:05
  • Trademarks don't unlaterally prevent using the exact trademarked name much less something similar. One doesn't need to be a large business to fight a litigants bringing vexatious lawsuits - I'm sure many lawyers will be happy to teach a large company an obvious trademark lesson.
    – iheanyi
    Oct 15, 2022 at 20:51
21

...and I'd gladly give it to them if asked.

What should I do?

If one of my employees purchased a misspelling of my company domain name under their own name. I would ask for the domain back, but even if they gave it to me without protest, it would still leave a bad taste in my mouth.

It's a boundary issue. If an employee does that, I really can't be sure that he really had innocent intentions to begin with.

It isn't just the domain name, it's all the potential random emails that could be intercepted by that domain name (whether its MX records get ever turned on or not).

And it's not really about email either. For me, it's really about my personal experience. The four or five times I've seen someone do that to someone else, it was usually some kind of passive aggressive power move on their part.

If I were you, I would just flag this issue with IT and with Legal, and let them figure it out. And if they don't do anything about it, I wouldn't press the issue.

5
  • 9
    Getting rid of an employee who has made it clear that he thinks the company should own that domain name and has offered it to the company is pathological.
    – cjs
    Oct 9, 2022 at 3:24
  • @cjs, No, he didn't say that. If he tells them that he's going to buy the domain name, that's one thing. But if he buys the domain name in secret and only offers them the domain name after they ask him about it. That's not cool. Oct 9, 2022 at 5:22
  • 10
    It seems clear to me from his overall tone that he's trying to do the right thing here, not sneak something by the company, and that his main worry is more that he'll try to tell the company about this and they won't list. I guess you just interpret the question differently from me.
    – cjs
    Oct 9, 2022 at 5:27
  • @cjs, No, you were right. In my attempt to underline a point, I exaggerated a little bit too much. I've just amended my answer. The bottom line is that I don't know what I would do, because there are too many variables to consider. But I still wouldn't have liked it. I work in Tech and I've seen too many people buy domain names for others, only to be "helpful", but then using their temporary ownership of the domain name as some kind of leverage in future negotiations. Oct 9, 2022 at 5:50
  • 6
    You're right that this is an area where the OP should tread carefully, especially because managers sometimes do over-react the way you did. (I myself have worked with people who deliberately chose to compromise security because they felt that following rules was more important than not compromising security.) But that's not a guaranteed route to avoiding trouble, either. It depends on who you're working with. Anyway, in this case there are other good reasons not to buy the domain name yourself.
    – cjs
    Oct 9, 2022 at 9:16
14

Waitaminute...

This is a typo in an email looking for surveys. It's not that they've registered the wrong domain name.

Find somebody in marketing or HR or whatever department is responsible for sending out the surveys and tell them. They'll correct the template for the email and move on with life.

Heck, you could probably just forward the email to the help desk with the incorrect domain (or just the two reversed letters) highlighted and tell them it's wrong and let the help desk sort out who should correct it.

Then, just shake your head in disbelief at the poor crap your company sends out and make sure you aren't making typos like that on stuff you're responsible for.

7

It's likely a simple typo of one employee.

You could simply notify the person or the team that sent out the request for survey. They will fix it right away.

The link in the email was a fairly subtle typo that I suspect is obvious, out of curiosity I checked the domain and saw it wasn't registered.

This means obviously there is no malicious intent of the person or team that sent out the email link for the survey.

Thus, there is no need to get panic. The typo will be fixed.

Everyone makes typos in their jobs occasionally. Who has never made a typo in their career ?

Nonetheless, I could register it anyway and just setup a general redirect and auto-response to emails saying it was the wrong person.

There is no need to do that.

5

Flag it as a data security issue, if you have a security and compliance officer. Otherwise legal. Then trust those people to handle it. Do not act on your own, unless you are IT staff allowed to do such things. But then you should have easy access to the people who decide about domain names.

3

Potentially, this can be a so-called "white-hat fishing" - special campaign to collect statistics like "how many opened the attachments", "how many are entering their domain creds there" etc. This could help focusing on the most vulnerable groups of users, arrange a training for them then, keep historical measurements about fishing awareness in your company (if the event is regular, not eventual), etc.

Anyway, you should report this as a security incident (or you can fall into "non-reporters bucket" if this is an actual fishing drill, not real threat). Don't be shy.

1

Tl;DR

Just report it to IT or whoever manages the surveyresponse email in your company and forget about it.


Nonetheless, I could register it anyway

I am having a very difficult time trying to figure out why you think that using personal funds on behalf of the company is a good idea.

just setup a general redirect and auto-response to emails saying it was the wrong person.

Per: "I have recently joined a non-IT department"

I question your decision and ability for involvement.

0

I think you're completely making a mountain out of a molehill, and reaching quite a bit in your proposed solution.

If you're suspecting that the type is obvious, why go further? Two transposed characters in a single internal company email does not warrant a technical solution. If it was an email address on a document distributed to customers, or on a web site, that'd be a different story.

You might work for a large company, but how many people actually received this email? And what is the actual potential (monetary, operational, or reputation) risk for the company if someone clicks the link? You're new, and you don't have any way of assessing that.

Best case: let it go. Worst case: forward to the helpdesk and let them deal with it.

In both cases, stay in your lane. If I were your boss and found out you started purchasing typo-domains, I'd find some reason that I didn't need you to work for me any more. It's completely overreaching, and an indicator of your work style.

0

What happened: Someone sent you an internal email with a misspelled company email address:

What is the risk: That person could send the same misspelled email address to people outside the company, and they won't be able to use the link. As a consequence, your company won't hear from them, or they figure it out and think you are numpties. No security risk.

That's it. Gently inform the person who sent this to you that they are giving out incorrect email addresses and to please stop doing that. Or less gently, CC someone in your IT department. There is zero point for the company to register all the hundred or so misspellings of their name. If you register it and this is found out, your IT department will find that very, very suspicious they find out.

Summary: Nothing to worry about, just tell the one person.

-6

You have no obligation to fix this, but its probably OK from a legal standpoint for you to buy the other domain names. The courts seem to have consistently ruled that a company doesn't automatically own all the domain names that are similar to their company name.

In the early days of the web there were all kinds of people who made a lot of money selling domain names that big companies wanted. I heard from some classmates once that the parents of someone I went to high school with sold the domain name "healthychoiceusa.com" for like 200K.

Your company doesn't own the other spellings, so I think there is no problem legally with you registering them. Still if they didn't like it, they could possibly fire you.

But, who knows, they just might wind up buying the domain from you one day.

And if they don't, just put some adds on there and take advantage of the free web traffic.

7
  • 4
    typosquatting is uncool.
    – user135112
    Oct 9, 2022 at 2:14
  • @Gantendo probably.
    – user4574
    Oct 9, 2022 at 4:51
  • 5
    Downvoted for the last sentence. Putting ads on a typosquatted page is really not cool.
    – wizzwizz4
    Oct 9, 2022 at 19:04
  • 3
    Yeah very common tactic. There are whole companies who do nothing but sit on domain names and selling them for 5 or even 6 figures
    – Kilisi
    Oct 10, 2022 at 2:32
  • On what legal grounds should they be able to fire them?
    – glglgl
    Oct 11, 2022 at 13:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .