The bit about the gmai.com mailserver is disturbing. One would imagine there are many other typo squatters with a similar setup.

    PORT     STATE SERVICE
    80/tcp   open  http
    443/tcp  open  https
    8080/tcp open  http-proxy

I park mine by having no IP address, MX record is "0 ." meaning it does not receive email, the SPF record is "v=spf1 -all" and DMARC is a strict reject, CAA is 0 issue ";", BIMI is "v=BIMI1; l=; a=;". I do the same for wildcard DNS. There's probably more I should add.

We did a large-scale study of this phenomenon recently: https://www.cs.bu.edu/faculty/crovella/paper-archive/wung-if...

Across a broad sample of typo domains of major sites, most registered domains aren’t actually reachable, implying they are registered for defensive, legitimate, or unrelated purposes. Interestingly, the typo space on major sites is actually very sparsely registered (2% at edit distance 1), meaning that typosquatting may actually be underexploited.

This just happened to me a month ago, I was waiting for a unused domain to expire. The domain was hosted on Epik (which I think is a trashy company but w/e).

About a month before expiration it somehow got renewed for 10 years, which is weird because it was not available ... and now is hosting a "get-rich-quick" scam that pretends a genuine Petro Canada campaign.

Yesterday I received spam with link on https://storage.googleapis.com/ that redirected to some parked domain.

Hopefully “direct navigation” does not become a boogeyman like “side loading” has.