If you or anybody can remember the source article, that sounds like an interesting read!

Edit: found one with a quick search. https://nakedsecurity.sophos.com/2011/08/10/bh-2011-bit-squa...

And https://www.researchgate.net/publication/262273269_Bitsquatt...

Here's original paper: http://media.blackhat.com/bh-us-11/Dinaburg/BH_US_11_Dinabur...

But I'm not entirely convinced that most of these requests weren't just typos. Though those requests with mismatched Host header surely were true bitflips.

There was some follow up work as well: http://blog.dinaburg.org/2013/09/bitsquatting-at-defcon21-an...

And I am beyond certain they were not typos; the requests were for long URLs that no one would be typing by hand. A few were for services that humans never enter urls into (like the Windows crash reporter).

Also here: https://www.youtube.com/watch?v=gXY3jm34RFU

I can't find it right now, but I also saw someone doing this with some version of Google Now (or what it was back then) and serving different assets into it.

A long time ago I did that with "CDN" domains. I bought ~10 of them (variations of fbcdn, akamai, and ytimg). I _did_ see some traffic (some hits per hour if I remember well), and many of them were from cheap handheld phones (from the user-agent).

That works for any domain that's busy enough.

Random bit flips happen on client machines and on routers.

If there are enough requests for a domain name, some of those requests will be subject to one one of those bit-flips.

That might just be typos in some cases?