Even though some organizations and companies may not realize it, their domain name is an important asset. Their web presence can even make or break companies. Therefor, “domain name abuse” is something that can ruin your reputation.

Losing control

There are several ways in which perpetrators can abuse your good name to make a profit for themselves, while ruining your good name in the process.

• Domain name hijacking
• Webserver takeovers
• Domain name abuse

The first two are closely related and are usually the result of an attack or breach of some kind.

Domain name hijacking can be the result of someone getting hold of your credentials and changing the server that gets to display the information when the domain is queried. Generally speaking, this is done by changing the DNS records for the domain and if the attackers are planning to prolong the use of your domain, they will move the domain registration to a different registrar. This is done to make it harder for the original owner to get control back over the domain. To pull this off they will need to get hold of your login credentials with the original registrar, either by phishing or by a data breach at the registrar. Many registrars will also ask for an Auth-Code when a domain holder wants to transfer a domain name from one registrar to another. So, it is wise to store this separate from your login credentials. Worst case scenario: the registrar cannot solve the issue for you. Even the ICANN will not be able to remediate the illegal domain transfer if your requests to the original and new registrar do not manage to get your control back.

Webserver takeovers are more of a physical attack on your own servers, whether they are on premise, hosted, or in the cloud. This is what we often see when websites are defaced or other attacks with a shorter lifespan. The results are easier to remedy as it usually only takes a backup of the old website to restore it to its old glory. Sometimes all you need to do is remove a few files that were added by the attacker. But the important part here is to find out how the attacker got access to the webserver(s) and how you can prevent it in the future.

A whole different, but related topic, we have discussed before is the use of expired domains for malvertising. While the technique is totally different, the end goal—malvertising— is of common interest.

Domain name abuse

But the main topic for this post will be domain name abuse, a much harder to grasp subject as it does not involve access to something that belongs to you. At best (or worst rather) the infringement is on your intellectual property.

Again, there are several possible scenarios.

• Typosquatting
• Domain name registration under another Top Level Domain (TLD)
• Replacing country code TLD’s (ccTLD’s)
• Using ccTLD’s to replace .com or other general TLD’s

Depending on the objective of the domain name abuse some strategies will make more sense then others. If the motive is email fraud then making the website look exactly like the one the perpetrator wants to mimic is more important than having a convincingly deceiving domain name. Especially since spoofing is another option that is often used in email fraud.

Typosquatting is the method of using domain names that are only a little bit different from the real one. They are usually only one typo away, hence the name. These names are often used on highly popular domain names to increase the chance of success. To use an example: goggle[.]com. (See? At first glance, it kind of works.)

Changing the TLD means the holder of the new domain changed the TLD expecting the reader will not notice or be aware of the switch they made. Yet another example: whitehouse[.]com.

Replacing country code TLD is basically the same method but this is a technique often used for banking fraud sites where a national bank is impersonated by giving it a more international TLD. For example: localbank.us becomes localbank.com.

The other way around happens as well. The international TLD gets replaced with a country code TLD Which also makes sense since many internationals use this method to direct traffic for local dealerships to the localized website. For example: Chevrolet also owns Chevrolet.de besides their own Chevrolet.com.

What is the purpose of the abuse?

Before we look at how we can respond to domain name abuse, it is important to establish what the purpose of the abuser is. The motives can range from downright malicious and illegal to trying to grab some extra traffic using your brand, which is not immediately illegal, per se. There are some grey areas between the two where legal actions may or may not have the desired result.

What is definitely not allowed is when the abuser tries to pretend to be a representative for your company or to act in your name without your consent. On the other hand, it is not illegal to hope that someone makes a typo. But like we said there is a big grey area between these two. Let’s look at an example.

In most countries it is not illegal to act as an intermediary between the public and an organization. Let’s take for example the intermediaries that ask for money to do the necessary paperwork for a US Green Card. Probably every country has at least one that offers to assist you to apply for one. For a fee of course. There is nothing illegal about most of them. The terrain gets shady, though, when the intermediary uses a domain name that could make the visitor think they are dealing with the U.S. Citizenship and Immigration Services (USCIS) directly. For example, by using the domain uscis[.]us. It gets downright illegal when the owner of the domain puts official logos of another company on his website. At that point they are impersonating the USCIS and can expect a takedown. For commercial companies such behavior can also be treated as an infringement on intellectual property.

Countermeasures

What are your options when you notice, or worse, get notified about domain name abuse? There are a few options to deal with websites that throw a negative shadow over your own:

• Ignore. In some cases, there are few other options, so your best strategy may be to not waste any time on the matter and hope it goes away.
• Contact the owner. If you look up the domain name there will be a contact email or abuse email of the registrar provided. This method may help in cases of an honest mistake, but your efforts are likely to be futile when there is malicious intent.
• Contact the registrar. You will need some luck and provide decent evidence to get a registrar to take down a website of one of their customers. Some registrars are known for their slow and reluctance to help victims of domain name abuse.
• In those cases you will have to resort to a so-called “Notice and takedown” procedure. Many countries have an independent authority that you can contact with complaints about their ccTLD’s. But these authorities will not be able to help you with international TLDs.
• Take them to court. Easier said then done when you don’t know who you’re dealing with. And even if you do, court rulings can take a long time and are costly. But sometimes threatening with legal proceedings is enough since they are costly for the other party as well.
• Make sure nobody finds the offensive sites. When the owners rely on search engines to find their site you can counter them there. Often, new sites rely on paid advertisements with search engines to bring in the necessary traffic. Your options are to file a complaint with the search engine or to simply outbid the opponent by paying more for advertisements pointing to your own site.

Required level of protection

There are very different levels of necessity for specialized services and systems that watch and report possible domain name abuse on your domain. Banks and other financials will probably have a whole department involved in takedowns, where your run of the mill pop and mom shop will be satisfied if they can keep their own site updated. Some companies will have an in-house department to keep an eye on possible domain name abuse which will be backed by a legal department that gets called in when necessary. Others will hire a specialized company to do this for them, while the vast majority has taken no precautions at all and will respond whenever a problem should arise.

And as long as your company is considered to be in the appropriate category there is not much reason to make any changes. Having a specialized department when there is absolutely no track record of domain name abuse and none is to be expected is a waste of time and money.

This article is provided by Malwarebytes Labs