The Spelling Police: Searching for Malicious HTTP Servers by Identifying Typos in HTTP Responses

This Fox-IT blog post (“The Spelling Police”) presents research into fingerprinting potentially malicious HTTP servers by detecting typos and small textual deviations in HTTP response headers using Levenshtein distance; the authors analyze ~800,000 responses, catalog common and rare anomalies, investigate examples via telemetry, and conclude that while typos can aid detection they are too common among benign services to be reliable on their own and should be combined with additional signals (e.g., header order, telemetry) for effective detection.