A recent blog post explained how the domain bafl.de could be used to receive DNS queries from the BAMF’s internal systems. An article on this topic was also published on fragdenstaat.de. A talk on this topic (video link – YouTube) was also given at the Chaos Computer Club’s (CCC) 39c3 event.
This blog post explains how, over the last 6 months, DNS queries from federal authorities were systematically recorded and analysed by registering typosquatted or bit-squatted versions of bund.de. In July 2025, security experts at Mint Secure GmbH registered, amongst others, the domain bund.ee. The findings were disclosed in a responsible manner and reported in advance to the Federal Office for Information Security (BSI / CERT-Bund).
The domain bund.de is the central administrative portal of the Federal Republic of Germany and serves as the official entry point to information, services and online offerings provided by the federal administration. Among other things, it provides access to contact details for government departments, administrative services, forms, calls for tenders and thematic information for citizens, businesses and organisations. The domain is used both for informational purposes and for digital administrative processes within the framework of e-government. bund.de is used and operated by federal authorities and federal institutions, which gives it a particularly high level of trustworthiness and relevance. Consequently, the domain bund.de is also an interesting area to investigate for potential attack vectors such as typo- or Bitsquatting. Most federal ministries use @abbreviation.bund.de addresses. Some of these web addresses deviate from this format.
What are typo- and Bitsquatting?
Having explained why bund.de is a fascinating subject of study, we will now explain what typo- and Bitsquatting actually are.
Typosquatting refers to a method whereby attackers deliberately register domains that differ only slightly from a well-known original domain in order to exploit users’ typing errors. The aim is to redirect visitors unnoticed to fake websites, for example to steal data, spread malware or display adverts. Common variants include typos (e.g. bumd.de instead of bund.de), character swaps or omissions (missing or swapped letters), and bit flips, which exploit technically induced character variations. Another form is TLD squatting, where the same domain is registered under a different top-level domain, such as .ee instead of .de. Homograph squatting is also widespread; this involves using similar-looking characters from other character sets, making counterfeit domains virtually indistinguishable to the human eye.
Bitsquatting was first presented at Black Hat in 2011 and is a specific form of domain abuse in which attackers register domains that differ from a well-known domain by a single flipped bit. This is caused by rare but possible bit errors during data transmission or in RAM, which inadvertently alter a character in the domain name. The problem is that users can consequently be redirected to third-party or malicious websites without any action on their part.
Mint Secure GmbH
In this case, the domain ‘bund.ee’ (an Estonian TLD) was chosen, which, within the TLD space, meets the criteria for both Bitsquatting and Typosquatting. A corresponding nameserver was also set up to log enquiries to the domain. A similar approach was presented by researchers from Cisco at Defcon as early as 2013.
Key findings after 6 months
Over an observation period of 6 months, it was monitored whether and how systems connected to the domains bund.ee, bund.se and bund.re. During this period, it was observed on several occasions that there were DNS queries directed at the name server that had been set up.
For example, connections were identified from the BMLEH (Federal Ministry of Agriculture, Food and Home Affairs), the BMI (Federal Ministry of the Interior) and the BMV (Federal Ministry of Transport), as well as from the resolving DNS resolver. The queries clearly originate from federal government departments (see IP address allocation).
Some of the queries can be attributed to the Federal Agency for Digital Radio for Public Authorities and Organisations with Security Responsibilities (BDBOS).
A connection to meet.bdbos.bund.ee is potentially dangerous, as this is not the official address meet.bdbos.bund.de, but a deceptively similar domain. Such minor variations are often deliberately used to mislead users. Attackers can use a fake domain to provide an almost identical copy of the legitimate platform and thus harvest login details, session information or other sensitive data (Phishing). Furthermore, such a domain is suitable for so-called Waterholing attacks: Users who regularly use the legitimate service are specifically redirected to the manipulated site or tricked into visiting it, which can be used to distribute malware or prepare further attacks. The apparent trustworthiness conferred by the familiar name significantly increases the likelihood of success.
Further information can be found in the talk ‘Lost Domains, Open Doors: What Old Government Domains Reveal’ from the Chaos Computer Club’s 39c3 in Hamburg at the end of 2025.
Timeline
- Approx. July 2025: Operation of a DNS server for the domain bund.ee (with bund.se and bund.re later added as Typosquatting domains)
- December 2025: Information provided to the BSI (CERT-Bund) regarding observations
- 28 December 2025: Talk at 39c3 on domains used by federal authorities
How Mint Secure supports you
Typo- and Bitsquatting on trusted domains is an often underestimated risk, particularly for public authorities and organisations with many subdomains. We support you with the following services:
Typosquatting and bitsquatting monitoring
We identify risky domain variants of your brand and monitor whether these are actively registered or being misused.
Domain portfolio audits
We check your entire domain and subdomain portfolio for misconfigurations and potential attack surfaces.
Phishing and watering hole protection
We provide consulting on technical and organisational measures to combat phishing and Waterholing attacks via counterfeit domains.
Ready to get started? We offer a free initial consultation.
Get in touch.
Conclusion
Over a period of six months, DNS queries from the networks of several federal ministries and the BDBOS were detected directing to typo- and bit-squatted variants of bund.de, including the deceptively similar domain meet.bdbos.bund.ee. This demonstrates just how real the risk of Phishing and Waterholing attacks via such domains is for federal authorities.
Combined with the previous discovery regarding bafl.de, it is clear that systematic management of their own domain portfolios is urgently needed for public authorities.
Mint Secure supports public authorities and businesses in identifying such risks at an early stage.
Talk to us.
