Researchers at Carnegie Mellon University registered 76 domain names built around common typing mistakes, such as misspellings of popular email providers, and collected the mail that arrived. Their study, presented at the 2017 Internet Measurement Conference, received millions of emails over seven months, most of them spam.

Janos Szurdi and Nicolas Christin estimated that three of their domains alone would receive about 3,585 legitimate emails a year that were meant for someone else. A small sample of those messages contained sensitive information, including visa documents and medical records. Registering a domain to catch mistakes like these is known as typosquatting.

Patient-facing healthcare apps send appointment reminders, result notices, and account messages to whatever address a patient typed, putting every typo in an email domain on the delivery path.

Read more: Why healthcare businesses choose Paubox Email API | The 5-minute guide to Paubox Email API | Understanding HIPAA violations and breaches

 

How a typo domain receives mail

Every domain that accepts email publishes a mail exchanger record, known as an MX record, telling sending servers where to deliver messages for that domain. A typo domain with an MX record accepts mail exactly as a legitimate domain does.

Szurdi and Christin found this setup is common. Their analysis showed millions of registered typosquatting domains with MX records pointing to only a handful of mail servers, and it projected that 1,211 typosquatting domains registered by unknown entities receive around 800,000 emails a year between them.

 

What happened to the mail

The researchers ran a second experiment, sending "honey emails" containing bait to typosquatting domains they did not control. Some of those emails were read, but the team found only limited evidence of attempts to use the bait for credential theft, and concluded the threat appeared to remain theoretical for now. Their paper notes that while most misdirected mail would be of little use to an attacker, some messages could carry sensitive information worth a large payoff. Its reference list includes the HIPAA definition of protected health information identifiers, which the researchers used in assessing what the misdirected messages exposed.

 

Why a delivery report shows success

A sending application learns what happened to a message through its email provider, usually as a delivery status. When a typo domain's mail server accepts a message, the transaction completes like any other, so the sender sees a delivered message rather than a bounce.

Transport encryption doesn't change that outcome. Transport Layer Security (TLS) protects a message as it travels to the server responsible for the domain in the address, which means a message sent to a mistyped domain is protected all the way to the wrong destination.

 

How HIPAA treats a misdirected message

HHS presumes that an impermissible use or disclosure of protected health information is a breach unless the organization can demonstrate a low probability that the information was compromised. A result notice delivered to a typosquatter's server is a disclosure to an unknown party.

OCR's guidance on emailing information to patients refers to reasonable safeguards when sending. MGMA's summary of that guidance lists verifying the identity of the patient and correctly entering the email address among them.

 

Where the Paubox Email API fits

The Paubox HIPAA email API encrypts every message and supports only TLS 1.2 and 1.3, and each account includes a business associate agreement, the contract committing a vendor to protect patient data. It returns the delivery status and delivery time for every message, giving development teams a record of the domains their application delivered to.

That record supports the address checks HIPAA's safeguards point toward. A team reviewing delivery data can spot recipient domains that sit one letter away from a major email provider and confirm those addresses with patients directly. For email sent by staff rather than applications, Paubox DLP inspects outbound messages for protected health information before they leave.

Learn more: Paubox Email API | Paubox Email API pricing | Paubox DLP

 

What an earlier experiment caught from company domains

Two researchers ran a related experiment in 2011 aimed at company domains rather than consumer email providers. TechMonitor reported that they bought 30 domains resembling the subdomains of large companies, missing only a dot, and collected about 120,000 wrongly sent messages, roughly 20GB of data, over six months. The captured messages included trade secrets, business invoices, personal information about employees, network diagrams, and passwords. The experiment relied on a single common mistake, a dropped dot between parts of a domain name.

 

FAQs

What is email typosquatting?

Registering a domain name built around a common typing mistake so that it receives email meant for the correctly spelled domain. A Carnegie Mellon study found millions of such domains configured to accept mail.

 

Will a misdirected email bounce?

Not when the typo domain accepts mail. The sending application records the message as delivered because the receiving server completed the transaction.

 

Does encryption protect a message sent to the wrong domain?

Transport encryption protects the message on its way to the server for the domain in the address. If the address is wrong, the message arrives at the wrong server intact.

 

Is a misdirected patient email a HIPAA breach?

HHS presumes an impermissible disclosure of PHI is a breach unless the organization shows a low probability of compromise, so a message delivered to an unknown party generally needs a breach assessment.

 

How can an app reduce misdirected messages?

Verifying addresses with patients and reviewing delivery records for domains that closely resemble major email providers both help. The Paubox Email API returns delivery status for every message, giving teams that record.