Technology & Innovation

Common domain-based brand abuse techniques and how to avoid them

April 11, 2017

Global

April 11, 2017

Global
Tim Chen

CEO

Tim Chen has been the CEO of DomainTools since its 2009 spin-out into an independent company. Tim has over 15 years experience as a sales and operations executive in internet-driven businesses, including 8 in the domain name and DNS space. Prior to this Tim spent seven years in business development executive roles with Internet and software companies in the Bay Area, and four years in the Corporate Finance group at J.P. Morgan in New York. Originally from Rochester, New York, Tim is a graduate of Haverford College and Stanford business school. 

Brands both large and small face increasing threats and risks as intellectual property becomes more vulnerable online.

According to a report issued by Interbrand, a global brand consultancy, the value of Apple, Coca-Cola and Louis Vuitton brands alone recently exceeded US$200bn. These and other well-known Fortune 500 companies invest great sums in building their brands and, not surprisingly, invest in fiercely protecting them.

“Brand abuse” is a broad term encompassing a wide range of offences that cost brands billions in losses or damage every year. At the domain name level, most methods rely on some form of deception, whether by “squatting” on slight misspellings of branded domain names, selling counterfeit goods from lookalike domains, designing branded phishing campaigns, or even hijacking legitimate corporate domains.

If there is any good news for brand holders, however, it is this: even sophisticated criminals tend to leave some digital “bread crumbs” behind, and organisations are becoming increasingly adept at exploiting these clues to protect revenues, maintain customer trust, and preserve the most valuable jewel in their intellectual property crown--their brand.

The “fatal four:” The most common brand abuse techniques at the domain name level

Cybersquatting, like most cybercrime, is done for profit and in this case is usually affected to steal legitimate internet traffic meant for corporate homepages.  It takes advantage of human error, either bad spellers or typing mistakes. One can imagine that a user in a hurry to check Facebook might accidentally type “faceboook.com” into the browser. Anyone who may have registered that domain name can then redirect the user to various kinds of abusive monetization including pay per click ads (often for competitors’ services), for-profit survey sites, or more nefarious content like ransomware. Any of these outcomes is a bad user experience for the brand’s customer, or worse.

Counterfeiting is the largest problem brands have, if they sell their products on the internet. Criminals will register illicit domains that mimic a target brand, build copycat websites on those domains, and sell knock-off goods, betting on user trust and brand equity to overcome any suspicion that the site doesn’t look quite like what they are used to. The inferior goods that are delivered (or, in the case of some scams, not delivered) damage the hard-earned brand equity with the customer and likely cost the company a sale in the process. On a dollar value basis this form of brand abuse is by far the most costly.

For example, a large US radio network and concert promotion business discovered smaller, lesser-known websites capitalizing on its established brand to entice users into buying fake song downloads and bogus concert tickets. Fraudulent discounted tickets not only represented a loss of nearly a million dollars a year, but also damaged the reputation of the brand for a company that counted on repeat and loyal customers.

Hijacking a corporate domain does not happen often, but when it does it is extraordinarily scary for the brand because of the control the cyberattacker has on the online voice of the company.  In this scenario the attacker, often a hacktivist, will wrest control of a victim’s domain from the domain registrar and change the name servers to ones they control. This is exactly what the Syrian Electronic Army did to Twitter.com and NewYorkTimes.com in a notorious 2013 attack. Protection against this form of cyberattack rests heavily with domain name registrars, but brand holders can help themselves by demanding registry lock functionality as well as two factor authentication at the registrar

Phishing is among the most common types of cyberattack seen today at corporations. Look-alike domains are registered (think “amaz0n.com” or “login-amazon.com”) in order to lure victims into entering confidential login, personal or financial information on picture-perfect reproductions of legitimate account pages. Spear phishing is a particularly nefarious form of phishing in which socially engineered context is added to emails purpose-built for specific individuals at a company.  Phishing can compromise internal employee accounts, and result in outcomes like a company’s entire customer database being leaked or sold on the darknet, which clearly is brand-affecting.

Online brand infringement: defensive techniques

Those companies that have fought brand abuse most effectively have built a chain of processes to protect themselves. They have iron-clad corporate domain control protocols. Many have taken to defensively registering their own typo variants and searching for other existing domains that contain their brand name. It is much better to own your own typo domains than to leave them available to someone else. At an average of £12 per year per domain, this is a relatively cheap insurance policy. To fight phishing, companies have implemented domain monitoring that reviews all new domain registrations that match or typo their brands, and they have also invested in employee training.

In cases where abuse is ongoing or costly, such as counterfeiting or hacktivism, security-forward organizations will move to actor profiling and attribution.  Domain name registration, hosting, and traffic data can be mined to do things like surface personally identifying information of brand abusers, map attacker infrastructure, and monitor for future threats.

Knowledge is power

The battle to protect brands and intellectual property online is only going to grow more complex. In many cases, the front lines of this battle are at the domain name and DNS level. And as we have discussed here, the cost of inattention is potentially enormous. Companies are well-advised to take advantage of domain and DNS-related data and tools in order to take proactive measures against all the forms of domain-based online brand abuse. 

 

 

The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.

Enjoy in-depth insights and expert analysis - subscribe to our Perspectives newsletter, delivered every week