Every typo is a destination: what exmaple.com reveals about internet noise

One missed letter can send traffic somewhere unintended. Cloudflare has owned exmaple.com for several years — a domain that exists only because example.com, the IANA-reserved placeholder domain used in documentation since 1999, is frequently misspelled. While autocorrect often fixes the error, configuration files and network settings don't have that luxury, so a steady stream of requests finds its way to the typo domain.

The traffic volume is substantial. Over 12 months between May 2022 and June 2023, exmaple.com received 2.48 billion HTTP requests — 243 million in April 2023 alone, up from a 6.07 million daily average in June 2022 to 8.13 million by April 2023. Nearly all of it, 99.99%, is bot traffic. Only 110,000 requests came from non-bot sources, with 40,000 uncategorized.

  • Bots dominated by percentage because exmaple.com is mostly referenced in automated contexts — routers, software tests, and monitoring systems misconfigured to point at the wrong domain.
  • The largest bot traffic spikes occurred December 8–9, 2022, with 11.8 and 11.85 million daily requests, respectively, in the week after Cyber Monday.

Traffic concentrates in specific regions and networks. France, Japan, Germany, and the US lead in request counts, driven largely by particular autonomous systems. Bouygues Telecom's AS5410 in France is the top contributor, generating over three million daily requests since February 2023. Cloudflare contacted the ISP, but the source remains unidentified — possibly an erroneous router or network configuration. Other notable spikes came from Worldstream (AS49981) in the Netherlands, Rostelecom (AS12389) in Russia, Deutsche Telekom (AS3320) in Germany, and Bell Canada (AS577).

The bot-heavy nature and specific ASN concentration suggest most traffic stems from network misconfigurations rather than individuals typing a wrong URL. Since example.com appears in router documentation and testing guides, a typo there can propagate into automated systems that keep sending requests indefinitely.

The protocol picture: mostly plain HTTP

Despite the modern internet's shift toward encryption, exmaple.com sees mostly unencrypted traffic — 76% HTTP versus 24% HTTPS. This reverses the typical pattern. Cloudflare Radar data shows HTTPS represents 99.3% of all non-bot requests and 80.8% of bot traffic across its network. Only 6% of human-related requests to the typo domain use HTTP, but that figure jumps to 76% when considering automated requests alone — evidence that the bot traffic driving most volume predates or ignores HTTPS defaults.

A low-level attack surface

Some malicious activity does target the domain, but at very low rates. The highest application-layer attack spike was 560,000 daily DDoS requests on December 9, 2022. WAF mitigations peaked at 10,000 requests on November 2, 2022. These aren't large-scale events, but they show even typo domains become targets for opportunistic scanning and botnets.

IP version usage is shifting. IPv6 now accounts for roughly half of unique daily IPs, up from 30% in May. This correlates with the services and bots generating most traffic — newer network infrastructure tends to deploy IPv6 more readily than legacy clients.

Who's asking: user agents and referrers

User-agent data offers limited insight. The most common values are empty or generic:

  • "Empty" — no user agent supplied.
  • "Mozilla/5.0" — used by nearly every mainstream browser, so it can't be attributed to a specific client or intent.
  • "Go-http-client/2.0" — signals a program written in Go making HTTP requests.

Known tools also appear: curl/7.66.0, Lavf/59.27.100 (FFmpeg), and python-requests/2.28.1. Some unusual user agents show up with a few thousand requests each, such as a GitHub library called Typhoeus and what appears to be a job-checking script for the site vercida.com.

Referrer data shows a similar pattern. Most requests come with an empty referer. The second largest source is exmaple.com itself, which is odd because the site has no links — a pattern suggesting internal looping or automated session behavior. A January 30, 2023 spike of 10,000 requests came from reddit.com, possibly because a misspelled example URL in a post gained traction. What follows: a distribution of HTTP referrers from the captured traffic:

Reddit posts referencing exmaple.com exist across subreddits, including Docker, AWS, and Svelte, dating back months. One post from January 31, 2023, on the Svelte subreddit relates to SEO configuration examples.

The human side: email sent to the wrong domain

Beyond web traffic, the domain accumulates email. Cloudflare configured a Gmail account to monitor messages to @exmaple.com starting in early 2022. Within 16 months, the 15 GB mailbox filled with 216,000 emails — an average of 432 daily. Many are marketing messages, some come from network tests, and others are people deliberately using a fake address rather than giving their real one.

A 30-day sample of emails revealed Nagios monitoring software as the dominant sender, accounting for nearly 83% of almost 4,000 emails. The subjects alternate between "PROBLEM Service Alert" and "RECOVERY Service Alert" for a company's ATM or backup system tests. These went to [email protected], where example.com was the intended recipient.

Beyond monitoring tests, the inbox contains messages from well-known brands — Microsoft, Apple, Google, PlayStation, Uber Eats, McAfee, and even the U.S. Patent and Trademark Office. Golf courses (31 emails from eight different facilities) and cruise ship companies also appear. Some senders clearly used fake addresses like [email protected] when signing up for virtual learning platforms.

Email authentication shows a gap in sender practices. Only 11% of recent emails passed DMARC, and most of those came from recognized senders like Apple, Uber, or Microsoft. The vast majority (83%, the Nagios-originated messages) have a DMARC policy of "none," meaning senders haven't implemented validation and aren't asking receivers to take action on failures. Just 1% of emails outright failed DMARC checks.

The example.com counterpart

The correct domain example.com sees far more attention. Data from Cloudflare's 1.1.1.1 resolver shows it receives roughly 2.6 billion DNS queries daily, more than doubling since 2022. It sits in the top 300 of Cloudflare's most popular domains ranking globally, and as of July 2023, entered the top 100 for the first time that year. example.org is likewise a fixture in the top 500.

The typo version receives much less DNS traffic — about 40,000 queries daily, with spikes to 80,000–90,000. One outlier reached 160,000 on July 23, 2022. Weekdays see more queries than weekends, which isn't the case for example.com, indicating work-related misconfigurations among the drivers.

"Some of the worst problems that happen on the Internet are not because somebody deliberately caused the problem. It's because somebody made a mistake. We've lost half the networks ability to transport traffic or route it to the right destinations because somebody made a configuration mistake." — Vint Cerf, in a 2016 interview.

Most traffic to exmaple.com lands harmlessly. But the same kind of typo, pointed at a deliberately registered malicious domain, could have real consequences — pushing traffic meant for a legitimate site toward an attacker-controlled page. The volume of requests this typo domain receives illustrates how configuration mistakes propagate at scale. Better simulation and configuration tools for network software and routers are, as Vint Cerf put it, needed to avoid the "stupid mistakes that cause problems on the Internet."