# Typosquatted CDNs: Skimmers Hiding Behind a Familiar Name

Skimmers served from domains registered one character away from a CDN you already trust, so the host survives the glance that a review gives it.

Provenance: Observed in Report URI report telemetry.
Published: 2026-06-04. Updated: 2026-08-24.

Most skimmer domains look like nothing in particular. They are registered a week before the campaign,
serve the payload for a few days, and mean nothing to anybody reading them. That is fine for the
attacker, because nobody usually reads them.

This family is built for the case where somebody does. Every host in it is registered a character or
a word away from something a developer already trusts: a CDN, a package registry, a JavaScript
library. If the domain appears in a script inventory, an allowlist, or a CSP violation report, it
reads as infrastructure that belongs.

## What they impersonate

The largest group targets jsDelivr, the public CDN that serves npm and GitHub packages. The real
service is on `jsdelivr.net`. We track skimmer hosts on three other endings, each with both the apex
and a `cdn.` label registered, because at the time they were added our matching was exact-hostname
and an attacker who moved between the two would otherwise have slipped one past us.

Alongside those sit a package-registry lookalike and a library lookalike. `packages.npm.org` reads
like an official npm host, and is not one. `static5-jquery.com` borrows the name of the most widely
deployed JavaScript library there has ever been, on a domain jQuery has nothing to do with.

## Why they get through a review

An allowlist review is somebody scanning a list for something that looks wrong. That works when the
attacker's domain is random, and it fails completely here, because the whole point of the name is to
survive exactly that scan.

It gets worse when a policy is built the common way. If you run a CSP in report-only mode, collect
what the browser reports, and allow what you see, then a skimmer already running on the page is
reported like everything else. Somebody reviews the list, sees what looks like a CDN, and allows it.
The policy that was supposed to stop the skimmer now permits it, in writing, with a review behind it.

## What actually separates them

The question that works is not whether a host looks legitimate but whether anybody chose it. You
know which CDNs you decided to use. Everything else on the page arrived some other way, and that is
true whether or not the name is convincing.

That is why a script inventory with a reason attached to each entry is worth more than an allowlist
on its own. `jsdelivr.net` has a reason: somebody picked it, for a library, on a date. `jsdelivr.info`
has no reason behind it, and the absence is the finding.

## What to look for

Compare the hosts in your reports against the CDNs you actually chose, character by character rather
than at a glance. The differences are small on purpose: a different top-level domain, an extra word,
a digit in the middle of a library name.

Two patterns are worth flagging immediately. A CDN host you cannot trace to a decision is one to
investigate whatever it is called. And a host that appears alongside a CDN you do use, serving
something similar, is the shape this family takes: the real one keeps working, so nothing breaks, and
the extra one is easy to miss.

## Indicators

- *.static5-jquery.com
- cdn.jsdelivr.biz
- cdn.jsdelivr.info
- cnd-lin-2026.com
- jsdelivr.at
- jsdelivr.biz
- jsdelivr.info
- packages.npm.org

## Questions

### What is a typosquatted CDN?

A domain registered to look like a well-known content delivery network, usually by changing the top-level domain or adding a word. jsdelivr.net is real; jsdelivr.info is not. The script it serves is a skimmer, but the name in your inventory looks like something you already use.

### Why doesn't a CSP stop this on its own?

It does if your policy names the exact origins you allow. It doesn't if the policy was built by allowlisting whatever showed up during a report-only period, because the typosquat was showing up too and went in with everything else.

### How is this different from a compromised CDN?

A compromised CDN is a real service that starts serving something bad, so the host in your reports is one you legitimately use. A typosquat was never yours. It got onto the page through an injection, and the resemblance is there to survive review afterwards.

### How do I find these on my own site?

Compare the hosts in your reports against the CDNs you actually chose, character by character rather than by eye. A script inventory that records why each source is there makes this quick, because anything without a reason is the thing to look at.