This is easily testable because:

1. Not all single char typos are bitflips and when you test it statistically you get more traffic for bitflips than typos. It's a bit more complicated, some typos are really common because they're close to the key.

2. You can look at the raw traffic that comes in and tell what is a simple get request with a fat finger (GET https://en.7ikipedia.org/ vs GET https://en.wikipedia.org/w/index.php?search=america&title=Sp...).

Source: I have some domains that are bitsquats of some high traffic domains. I get access token headers when I do a raw dump of the traffic. (I turned off the servers after satisfying my curiosity.)

Want to stop randos from getting some tiny portion of your traffic's access tokens? Use client side keys and send signed / encrypted access tokens or even full requests.

Yeah I know. It's so far down the list it doesn't matter. But every combination of github.com, microsoft.com, etc is bitsquatted, so this attack can be considered ongoing. This is doubly true if you're on a domain like .co.uk which is a stupid subdomain of .uk and now that .uk addresses are available someone can buy ko.uk and bitsquat the entire fucking country.

An interesting control would have been to flip a single bit but also flip a single char so that it flips several bits and compare the results.

edit: Reading the linked article, they describe one of their validation method: > The Host header contains the domain the HTTP client resolved to connect to the bitsquat server. If the Host header matches the original domain, the corruption occurred on the red path (DNS path). If the Host header matches a bitsquat domain, the corruption occurred on the blue path (content path).

I think the article gives good reasons to believe they are not typos, why do you think otherwise?

While i like the sibling comment's network errors answer better then mine I didn't see any reasoning other then a unfounded statement[1] in the article or on a quick skim for "typo" in the referenced whitepaper:

[1] "These requests were not typos or other manually entered URLs"

Here's a better quote: "There are many frequently resolved domains that few people type or know."

There's a lot more details in the article.

Not to mention, the number of people typing "fbcdn.net" into a browser has to be vanishingly small to begin with.

Is that why some Microsoft download URL with a GUID in it made it to his server? Typo in Windows Update?

I don't think that sounds right.

None of them were typed in. I was bitsquatting a CDN that no one would type into the browser bar. Everything was some resource referenced from a page. If you checked the original page, the correct URL was present in that page.