Summary

  • At RIPE 92’s closing plenary, Warren Kumari described registering names one memory bit away from other domains, then watching requests reach his server. He logged host names, SNI, URLs and cookies and tried to filter out ordinary typos and automated noise.
  • He considered asking for a rule against new top-level domains one bit from existing ones. His check found about 60 such pairs already present. The official talk record identifies this as a ten-minute update on bitsquatting, not a filed or adopted policy.

The first surprise was not that a flipped bit could make a different domain name. It was that someone would visit it. Kumari wrote a tool to find domain names that remained valid after one bit changed, registered some of the results, and put a server behind them. At RIPE 92 on 22 May 2026, he showed what arrived: names requested by software, URLs, SNI values and cookies. A faulty memory cell had acquired a route to the web.

He knew a hit counter would flatter the experiment. Bots scan every new domain, and fingers hit wrong keys. So he chose some names whose letters were far apart on a keyboard, looked for long system-generated host names and API paths, and filtered obvious automated traffic. The plenary transcript records his method and his caution. It does not provide a released request dataset that would let another analyst assign a cause to every visit. His observations still show that a registered one-bit neighbour can receive traffic meant for somewhere else.

The contents made the detour more serious than a stray page view. Kumari reported thousands of requests for JavaScript files and many cookies, some resembling authentication tokens. He described TLS sessions that continued to his controlled name and sent cookies despite the mismatch he expected a certificate check to catch. The outcome depends on where the bit changes in the stack. He did not report using those credentials against their owners. The point is that a destination error can carry more than a mistaken GET request.

Then he turned from the server to the root zone. With another round of new gTLDs in view, Kumari thought about proposing a simple exclusion: do not delegate a new top-level domain one bit away from an existing one. Before writing it up, he tested the current namespace. He reported roughly 60 pairs already separated by only one bit. A rule for tomorrow’s applicants would leave yesterday’s neighbours in place. That is an awkward discovery for anyone hoping a clean assignment rule will erase the fault path.

Kumari did not present a completed ICANN proposal. His talk ended with a narrower operational thought: error-correcting memory helps, but people do not control the hardware in every phone and device that makes a request. Registries decide what names are available; software and hardware decide what name is sent. Both choices affect the same trip, and neither side can outsource the whole problem to the other.

The sharpest question now belongs to whoever controls a one-bit neighbour. A registry can inspect future applications; operators can watch where their own requests go and how clients handle a bad destination. Kumari’s small server showed the existing namespace deserves that attention before a policy drafter congratulates themselves on closing the next gate.