Typo traps: analyzing traffic to exmaple.com (or is it example.com?)
Sep 22, 2023João Tomé

Summary
This post analyzes traffic patterns to exmaple.com, a domain used to capture typosquatting and misconfiguration-related traffic. It details the volume, type (bot-dominated, mostly unencrypted HTTP), origin (specific ASNs like Bouygues Telecom, Google Cloud, Worldstream), and IP version (increasing IPv6 usage) of this traffic. The analysis reveals that much of this traffic is likely due to misconfigurations in routers or network settings intended for example.com, and highlights the financial cost of handling such unintentional traffic. It also touches upon the use of example.com for testing and educational purposes in network configurations.
More from the DNS Infrastructure & Naming Conventions trail
- The keys to the Internet change on October 11, 2026. Are you ready?
- 1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it
- How we saved 100 terabytes of memory by optimizing 1.1.1.1’s DNS cache
- BGP ORIGIN attribute manipulation and its impact on the Internet
- Cloudflare Internal DNS is now generally available