The world of the bitsquat

BLOG POST

Bitsquatting is a way of launching a potential attack against a trusted website. It is reliant on the fact that, in some cases, the binary-string representation of the requested URL can become corrupted in transit, with a '1' being flipped to a '0' (or vice-versa). Ordinarily this would result in an invalid URL being produced, but in cases where the corrupted version is a valid URL in its own right, bad actors can register these variant domain names as a way of intercepting traffic intended for the legitimate site. This is analogous to cybersquatting or typosquatting, with no requirement to compromise the site explicitly. 

In a new study, we consider the bitsquat variants of each of the top 50 most popular websites, as of March 2024. Of the 1,553 valid domain names which could be used to launch bitsquatting attacks, only 125 appear explicitly to be under the ownership of the brand in question (or under other legitimate usage). Only 43 of these have been configured to re-direct to the official website in question. 

Of the remainder, at least 87% appear to be registered by third parties. Although some represent legitimate usage of the brand-name variant in question, many appear to have been registered with malicious intent. One active example of a lookalike site was identified in the dataset, in addition to many more misdirecting web traffic to similar content, or which have been monetised through the inclusion of pay-per-click links or offers to sell the domain names. Many of these present the potential to be 'weaponised' for use in attacks at a later date. 

There are a number of options available to brand owners to mitigate these risks. The first is the defensive registration of the bitsquat variants of their primary domain names, and active monitoring for - and enforcement against - identified infringements. Other possibilities include the use of domain extensions which are not amenable to bitsquat attacks, appropriate use of subdomains, and increased use of relative (rather than absolute) hyperlinks in the HTML of their websites.  

In practice, bitsquatting is not an attack vector which has been extensively exploited by bad actors to date. Nevertheless, it does raise some significant risks in the limited instances where it occurs, and is of particular concern in cases where a carefully selected registration can allow an attacker to target all domains on a specific extension. Realistically, some of the suggested remediative actions will only be appropriate in limited instances, and are often likely to be superseded by other branding considerations. However, the most advanced domain management and registration policies should certainly bear the issue in mind as a potential risk factor, and some simple steps (such as also registering the variant .tk version to accompany a .uk domain) can easily be made to improve the risk profile for brands.

This article was first published on 16 May 2024 at:

https://www.iamstobbs.com/opinion/redirecting-into-the-world-of-the-bitsquat

* * * * *

WHITE PAPER

Introduction to bitsquatting

Many previous descriptions of techniques used by infringers have discussed ways in which deceptive URLs can be created, to misdirect Internet users and drive web traffic to non-legitimate sites^[1]. One related tactic concerns the issue of 'bitsquatting'.

As part of the technical process taking place when a user attempts to access a website, the URL is converted to a string of individual characters, each of which is represented as a unique ASCII code^[2] - essentially, a number between 0 and 255, forming a range covering all allowable characters - which is then converted to its binary equivalent. For example, the character 'a' (lower-case a) is ASCII number 97 which, in binary, is 1100001^[3]. This is generally expressed as an eight-binary-digit ('8-bit') string (or one byte, in IT terms), by adding leading zeroes as necessary (i.e. 01100001 in this case)^[4]. However, when accessing a website, the string needs to be copied in and out of computer memory multiple times^[5], and in some cases a corruption of the binary string can occur, due to factors such as hardware faults or electromagnetic interference^[6]. Generally this manifests as one of the '1's being 'flipped' to a '0', or vice-versa. If this occurs, a different character is obtained when the binary string is decoded. In many cases, this would mean that there would be an error in accessing the website (e.g. if a request to access google.com was corrupted to gokgle.com, nothing would be found if this typo-variant domain did not exist). However, infringers can take advantage of this possibility, by proactively registering ('bitsquatting') the specific domain variants which may arise (e.g. by specifically having registered gokgle.com, in the above example), so that any such corrupted requests are instead directed towards their own content.

Note that this route of attack is not reliant on compromising the site in question, but rather takes advantage of hardware errors which can occur naturally. An early analysis by Black Hat^[7] considered the targeting of eight legitimate domains using 31 bitsquatted variants, finding that over 52,000 web requests were made to the bitsquat domains over a six-month period.

Furthermore, a 2013 study^[8] found a number of instances where bitsquatted domains were actively being utilised for brand abuse. These included a case where variants of huffingtonpost.com were being used to direct users to a page promoting the sale of hardware products, and one where variants of microsoft.com were being used to distribute malware or fake antivirus products.

The technical framework described above means that (considering only instances where a single binary character ('bit') is corrupted), there are up to eight possible bitsquatted variants of any given character (i.e. one for the transposed version of each individual bit). These are listed in Table 1.

Note that in this analysis:

• We consider only the alphabetic characters (a – z), the numerals (0 – 9), and the characters '-', '.', '/' and '#', which can appear in a domain name / URL.

• We do not consider case variants, partly because domain names / URLs are (generally) case-insensitive, but also because upper- and lower-case versions of the same character differ by ASCII values of 32 (i.e. differ in a single bit) - e.g. 'a' is ASCII 97 (01100001) and 'A' is ASCII 65 (01000001), so upper- and lower-case versions of the same character will always bitsquat-'match' each other, and their other [alphabetic] bitsquat variants will also differ only in case (e.g. the variants of 'a' will be ('A'), 'q', 'i', 'e' and 'c', and the variants of 'A' will be ('a'), 'Q', 'I', 'E' and 'C').

• We also exclude other non-Latin characters since, although these can be used in domain names, they are generally treated differently, and usually expressed in Internet technology applications in Punycode format, which uses only Latin characters (e.g. where hermès.com is expressed as xn--herms7ra.com)^[9].

Character	1	2	3	4	5	6	7	8
a				q	i	e	c
b				r	j	f		c
c		#		s	k	g	a	b
d				t	l		f	e
e				u	m	a	g	d
f				v	n	b	d	g
g				w	o	c	e	f
h				x		l	j	i
i				y	a	m	k	h
j				z	b	n	h	k
k					c	o	i	j
l					d	h	n	m
m		-			e	i	o	l
n		.			f	j	l	o
o		/			g	k	m	n
p		0			x	t	r	q
q		1		a	y	u	s	p
r		2		b	z	v	p	s
s		3		c		w	q	r
t		4		d		p	v	u
u		5		e		q	w	t
v		6		f		r	t	w
w		7		g		s	u	v
x		8		h	p		z	y
y		9		i	q			x
z				j	r		x
0		p			8	4	2	1
1		q			9	5	3	0
2		r				6	0	3
3		s		#		7	1	2
4		t				0	6	5
5		u				1	7	4
6		v				2	4	7
7		w				3	5	6
8		x			0			9
9		y			1			8
-		m					/	,
.		n						/
/		o					-	.
#		c		3

Table 1: Bitsquatted variants of each character permissible in a standard domain name / URL; columns show the variants based on the transposition of the bit number^[10] shown in the column heading

In general, (assuming only one bitsquatted character is present in any given case) this means that the bitsquatted variants of any given domain name will form a subset of the domain names comprising 'fuzzy' variants (where any character can be replaced by any other character). Therefore, a domain monitoring solution which incorporates fuzzy matching will - by definition - detect these bitsquatted variants, without needing to monitor for them explicitly. However, there are some exceptions to this principle, mostly arising from the inclusion of the '.', '/' and '#' characters in the set of variants^[11]. The main additional categories of potential bitsquats are as follows:

• Subdomain-related variants (with a '.') - These can arise because of the potential for 'n' and '.' to substitute for each other. This gives rise to two types of potential bitsquat:

• Instances where an 'n' is replaced by a '.', such that the bitsquatted domain is a truncated version of the original domain, e.g. where windowsupdate.com could be replaced by wi.dowsupdate.com (such that the bitsquatted variant domain name would be dowsupdate.com).

• Instances where a '.' (e.g. as used in an active hostname, or subdomain / domain-name combination) is replaced by an 'n', e.g. where s.ytimg.com (a hostname used by YouTube for content delivery) would be replaced by snytimg.com. There are a range of popularly-used hostnames which might be susceptible to this type of attack, including several used for affiliate- or other URL-tracking services.

• URL-delimiter variants for a '/' - These arise because of the potential for substitution between '/' (which forms bitsquat variants with 'o', '-' and '.') and any of these other characters. Again, this implies two types of potential bitsquat:

• Instances where a relevant character is replaced by a '/', which can constitute a valid bitsquat if the preceding characters form a valid domain name (e.g. ecampus.phoenix.edu being replaced by ecampus.ph/enix.edu (i.e. with a variant domain name of ecampus.ph), or trading.scottrade.com being bitsquatted using trading.sc). A similar principle can affect a character at the start of a domain name, working on the basis that the resulting string ('http:///' - with three slashes) would generally be 'corrected' by a browser.

• Instances where a '/' is replaced by a relevant character. This could potentially affect the second slash in a URL (giving 'http:/' - with one slash, which would also usually be 'corrected' by a browser) or the third slash (after the domain name), if this generated a valid alternative domain name.

• URL-delimiter variants for a '#' - These arise because of the potential for substitution between '#' and 'c' or '3'. The '#' character can be used in URLs to prepend URL fragments (e.g. when specifying anchor tags on a webpage). Examples might include cgportal2.uscg.mil being substituted by cgportal2.us#g.mil or isbc.com.cn being substituted by isbc.com.#n - again, the arising syntactical errors will often be 'corrected' by a browser (so cgportal2.us and isbc.com could potentially be used to launch successful bitsquatting attacks in these cases).

Additionally, bitsquatting attacks can also take advantage of the possibility for TLDs (top-level domains, or domain extensions) to substitute for each other (e.g. .uk being substituted by .tk), or for a character in the TLD to replaced by a '.' or other URL delimiter (in cases where the subsequent part of the TLD string was also a TLD in its own right), which could provide the potential to bitsquat all domains hosted on the TLD in question - e.g. .cleaning being replaced by .clea.ing, .photography being replaced by .ph/tography, or .auction being replaced by .au#ction.

Bitsquatted variants of the top 50 most popular websites

As an investigation into the extent of bitsquatting as a potential attack vector, we consider the utilisation of the bitsquatted variants of each of the top 50 most popular websites (as of March 2024), according to Similarweb^[12]. This list (topped by google.com, youtube.com, facebook.com, instagram.com and twitter.com) features domain names covering a range of TLDs, as shown in Table 2.

TLD	No. instances
com	39
ru	3
org	2
co.jp	1
tv	1
desi	1
us	1
me	1
ne.jp	1

Table 2: TLDs represented in the set of the top 50 most popular websites

Considering the potential bitsquats of each of these 50 websites yields a dataset of 1,553 valid domain names which could be used to create a bitsquatted variant of one of the domain names in question. Only one domain name, g.com, appears as a duplicate in the list (in the variants bi.g.com (for bing.com) and samsu.g.com (for samsung.com)), but which - in practice - as a one-character .com domain is anyway unlikely to be available for registration. The 1,553 domain names occupy a wider range of TLDs (Table 3) than the original dataset of 50 websites, arising due to cases where bitsquatting of a character in the domain-name extension produces another valid extension^[13] (Table 4).

TLD	No. instances
com	1,203
org	90
ru	60
bom	39
desi	39
tv	29
ne.jp	26
co.jp	20
us	15
me	5
su	3
vu	3
rw	3
re	3
jp	2
ee	1
md	1
mm	1
ws	1
tr	1
tt	1
ie	1
tw	1
ma	1
mu	1
mg	1
tf	1
es	1

Table 3: TLDs represented in the set of domain names appearing in bitsquatted variants of the top 50 most popular websites

TLD	Valid variants
com	bom
me	ee, ie, ma, md, mg, mm, mu
ru	re, rw, su, vu
tv	tf, tr, tt, tw
us	es, ws

Table 4: Valid variant TLDs appearing in the bitsquatted dataset

Within the dataset of bitsquats, there are 12 instances of valid hostnames (i.e. subdomain plus domain-name combinations). Of these, only two (li.kedin.com (a variant of linkedin.com) and pi.terest.com (a variant of pinterest.com)) were found to be in active use, both redirecting to pay-per-click parking pages offering the respective domain names for sale).

Of the 1,553 potential bitsquatting domains, only 125 appear explicitly to be under the ownership of the brand in question, or under other legitimate usage (on the basis of the citation of official registrant details, or of an enterprise-class registrar, in the whois records). 43 of these have (sensibly) been configured to re-direct to the official website in question.

Of the remainder, all except 179 (i.e. at least 87%) appear to be actively registered by parties other than the relevant brand owner (on the basis of a whois record being returned and/or the presence of a live website response). Some of these will, of course, also represent legitimate use (in cases where the bitsquatted variant forms a legitimate alternative brand name or website in its own right), but there is clear potential for significant abuse within the dataset, particularly where the variant domain name does not appear to constitute any meaningful string other than as a variant of the brand name in question.

Within the set of third-party registrations of valid bitsquatted variants which return live webpages, there are also, however, a number of examples of potential concern. As of the time of analysis, only one example was identified of a variant domain name actively apparently being used to impersonate the website in question (Figure 1), but many others were found to be displaying third-party content with a subject- or industry area similar to that of the corresponding top50 website - particularly in cases of adult-content brands (i.e. comprising instances of brand abuse and traffic misdirection). Many more examples were found to have been monetised through the inclusion of PPC links or pages offering the domain names for sale and, given the nature of the risk, it would be advisable to monitor the dormant domains for any changes to website content.

Figure 1: Example of a lookalike Pinterest website hosted on a bitsquatted variant domain name

Conclusions

The technical issue of potential bit corruption in URLs makes bitsquatting a highly effective attack route for infringers and fraudsters. It would generally be advisable to brand owners to defensively register the (relatively small number) of bitsquatted variants of their primary domain name(s) as a way of mediating such attacks (including variant TLDs where possible / appropriate - e.g. registering the variant .tk version to accompany a .uk registration). However, for the top 50 most popular websites globally, this defensive approach has seen relatively limited adoption, and significant numbers of the domain names which could be used for attacks of this type have been registered by third parties. In many cases these are in active use for traffic misdirection or as revenue generators. It is also concerning that many restricted domain name-spaces (i.e. those where specific registration requirements or limitations are in place) are susceptible to bitsquatting attacks.

Other tactics which might effectively be employed by brand owners or industry organisations to prevent bitsquatting (as summarised in the previously referenced Cisco white paper) might include:

by brand owners:

• appropriate selection by brand owners of suitable TLDs for their primary website (i.e. those where the bitsquatted variants do not produce valid domain extensions) – note that, whilst this is technically a remediative option, in practice it is likely to be overruled by branding or SEO (search-engine optimisation) considerations (e.g. the favourability of .com as a primary domain name extension

• careful selection and use of subdomain names

• use of relative, rather than absolute, hyperlinks in HTML content (to minimise the number of times the domain name needs to be loaded in and out of computer memory)

• use of capital letters (which generally have fewer bitsquat variants) in the (limited) sections of URLs which are case sensitive

by other organisations:

• restrictions by registries on the registration of domains featuring keywords (such as 'www') which are conducive to this style of attack, or of registrations by any out-of-territory registrants

• introduction of mandates to include error checking against bitsquats in hardware devices^[14]

The findings presented in this study also highlight the importance of a brand monitoring approach able to detect the registration of the candidate URLs, carrying out analysis of content, and the implementation of rapid and effective enforcement in cases where abuse is identified.

References

[1] 'Patterns in Brand Monitoring' by D.N. Barnett, Chapter 7: 'Creation of deceptive URLs' [awaiting publication]

[2] https://www.ascii-code.com/

[3] Binary (base-2) 1100001 = (1 × 2⁶) + (1 × 2⁵) + 1 = Decimal (base-10) 97

[4] https://www.totalphase.com/blog/2023/05/binary-ascii-relationship-differences-embedded-applications/

[5] http://dinaburg.org/bitsquatting.html

[6] https://en.wikipedia.org/wiki/Bitsquatting

[7] https://web.archive.org/web/20180713212603/http://media.blackhat.com/bh-us-11/Dinaburg/BH_US_11_Dinaburg_Bitsquatting_WP.pdf

[8] https://www.securitee.org/files/bitsquatting_www2013.pdf

[9] https://www.iamstobbs.com/idns-ebook

[10] Reading from left to right in the byte, i.e. with the largest-value bit first

[11] https://media.defcon.org/DEF%20CON%2021/DEF%20CON%2021%20presentations/DEF%20CON%2021%20-%20Schultz-Examining-the-Bitsquatting-Attack-Surface-WP.pdf

[12] https://similarweb.com/top-websites/

[13] https://data.iana.org/TLD/tlds-alpha-by-domain.txt

[14] https://sec.okta.com/articles/2020/11/why-bitsquatting-attacks-are-here-stay

This article was first published as an e-book on 16 May 2024 at:

https://www.iamstobbs.com/the-world-of-the-bitsquat

IP and digital due diligence: constructing a domain policy that Matches brand owner requirements

Following the placing of luxury e-commerce platform Matches^[1] (formerly Matchesfashion) into administration by owners Frasers Group^[2] in March 2024^[3], Mike Ashley's Frasers has at the end of April repurchased the company's intellectual property (domain names, trademarks and store databases). They have not, however, purchased the £80 million worth of stock or 250 remaining employees^[4].

Introduction

Matches was established as a physical store in 1987, before expanding to an online e-commerce platform in 2007^[5]. The company was acquired by Frasers for £52 million in 2023 from private equity firm Apax Partners^[6,7], who had purchased it around six years earlier for an estimated £400 million^[8].

In this article, we take a look at the potential landscape of the Matches domain name portfolio and use it as a case study to consider some points related to a suitable registration and domain-management policy for the brand^[9].

Methodology

Given the generic nature of the 'Matches' brand name, it makes sense to consider in an initial landscape analysis only those domain names of greatest potential relevance. The first step is to focus on those where the brand name appears at the start of the domain name. As of the date of analysis (01-May-2024), 480 registered domains with names beginning with 'matches' were identified. Many of these are clearly not relevant, so we next filter the dataset to consider only those where the SLD (the second-level domain name, i.e. the portion to the left of the dot) consists only of the term 'matches', or where other relevant terms (i.e. those related to fashion, commerce, or other generic terms such as 'online' or other geographic terms) are present. This yields a dataset of 184 domain names of potential relevance.

The first point to note is that, given the generic nature of the brand, it is unlikely that the brand owner will want (or easily be able) to acquire all domains of the form matches.[TLD]. Indeed, the company's primary website is matchesfashion.com, and even the brand-name-only .com (the most popular TLD) domain (i.e. matches.com) is under the ownership of a third party (it currently re-directs to world.com, displaying content relating to the sale of 'premium domain names').

The next point of significance is that Matches' official primary website domain is actually registered via a proxy service ('Domains By Proxy, LLC') meaning that it is difficult to definitively verify which domains are under official ownership. However, there are 53 domains within the dataset which re-direct to matchesfashion.com – covering a small number of matches.[TLD] domains, a larger group of domains where the SLD is 'matchesfashion' or 'matches-fashion', and a small number of others (featuring additional keywords such as 'store', 'site' or 'website'). Many of these are also registered via Domains By Proxy and seem likely to comprise (at least part of) the official domain portfolio. Some are explicitly registered with alternative contact details, and may be of concern (and warrant careful monitoring and potential enforcement) if not actually under the control of the brand owner. As a general recommendation, it might be appropriate for brand owners to consolidate all official registrations under a single (ideally enterprise-class) registrar, and standardise the contact details cited in the whois record (usually with official corporate information).

Analysis

From amongst the remainder of the (probably third-party-owned) dataset domains in this sample landscape (53 of the form matches.[TLD] and another 78 featuring additional keywords), a number of relevant insights can be drawn:

• The dataset includes several examples of additional domains with SLDs of 'matchesfashion' or 'matches-fashion', i.e. the brand owner's apparent preferred domain-name format.
• There are numerous domains comprising misspellings of 'matchesfashion.com'.
• There are several domains with names featuring variants of 'matchesboutique', 'matchesonline', 'matchesworld' and other relevant keywords.
• Some domains (including several of the misspellings) resolve to pages featuring pay-per-click links, indicating an effort to take advantage of the brand name and monetise the content.
• Some of the registrations are likely to pertain to legitimate third-party use of the 'Matches' name.

In addition, there are a small number of findings of greater concern:

• Two of the misspellings (matchesashion.com and matchesfshion.com) re-direct via affiliate-tracking URLs to the official matchesfashion.com site. Whilst this is most likely purely a revenue-generation scheme, there is potential for the domains to be used fraudulently, with the re-direction to the official site designed to provide the appearance of legitimacy.
• Four of the sites resolve to a log-in page (Figure 1), presenting the potential for fraudulent use (e.g. phishing).
• One domain resolves to a third-party site using the 'Matches' name in a similar industry area (Figure 2).

Figure 1: Screenshot of a log-in page displayed by four of the third-party domains in the dataset

Figure 2: Screenshot of a third-party site using the 'Matches' name in a similar industry area

Approach

Based on these findings, the following general recommendations regarding a domain registration and management portfolio may be appropriate:

• In cases where any of the third-party sites feature active infringements, it would be advisable to launch enforcement actions to deactivate the content, and/or consider a dispute procedure if the brand owner wishes to reclaim the domain for their own portfolio.

• If any of the other third-party-owned domains are required for the official portfolio, it may be appropriate to attempt to acquire them through purchase or dispute.

• Outside the set of domains which are currently registered, it may make sense (depending on the balance between budget and risk, and on planned future business expansions) to attempt to purchase domains featuring relevant keyword patterns, across relevant TLDs, for inclusion in a core / tactical (i.e. defensive and strategic) portfolio. Some of the key domains of potential interest might include:

• Those featuring the brand name together (say, with and without hyphens) with relevant keywords, such as 'fashion', product keywords such as 'designer', 'luxury', 'clothing', etc., and potentially terms such as 'shop', 'store', 'outlet' etc. (particularly given the 'Matches Outlet' branding used on the official website), and/or other relevant generic or geographical keywords. Note that this may include domains where the brand name does not necessarily appear at the start.

• Domains across TLDs relating to the brand's current or future planned geographical areas of business, or which relate specifically to the industry area or e-commerce generally (e.g. .fashion, .boutique, .luxury, .moda, .shop, .store, etc.)

• It may also be appropriate to register domains featuring other relevant terms, such as brand taglines.

The general principle is usually to achieve coverage across a wider range of TLDs for the higher-relevance keywords / SLDs (e.g. 'matchesfashion' in this case).

• Beyond the construction of an official portfolio, it is generally advisable to monitor for the registration of relevant domains, and the potential appearance of infringing content, with a view to taking subsequent enforcement where appropriate. This might particularly be relevant for misspellings, where it would be unsustainable to attempt to defensively register all variants pre-emptively.

Take-homes

The re-purchase of the Matches IP portfolio, for a greater sum than the purchase of the whole company a year earlier, provides a striking illustration of the extent to which the value of a brand can be dominated by its intangible assets. However, the value and usefulness of a set of domain names is limited by the quality of any domain management policy which underlies it. Policies of this type are a key consideration for brand owners, incorporating insights from analysis of the pre-existing state of official and third-party registrations, and taking into account the balance between registration and renewal costs, and business requirements for core and tactical domains, covering brand variants, relevant keywords, and appropriate domain-name extensions (top-level domains, or TLDs).

Frasers' last acquisition of the Matches brand was short-lived, and the brand has had multiple owners in two decades, potentially giving rise to different approaches and competing commercial interests, such as factors regarding the spend on IP versus commercial operations. Stability of the ownership and management of Matches may assist with the brand’s future IP portfolio rationalisation. After all, a carefully managed and properly executed policy can help brand owners maximise their value for money, control their IP, manage infringements and help to strengthen the brand overall.

References

[1] https://www.matchesfashion.com/

[2] https://frasers.group/

[3] https://www.retailgazette.co.uk/blog/2024/03/matches-administration/

[4] https://www.retailgazette.co.uk/blog/2024/04/frasers-matches-ip/

[5] http://www.managementtoday.co.uk/article/1668609

[6] https://www.independent.co.uk/business/frasers-group-buys-matches-fashion-for-ps52m-b2467208.html

[7] https://www.businessoffashion.com/articles/retail/mike-ashleys-frasers-group-buys-matchesfashion/

[8] https://www.theguardian.com/technology/2017/sep/01/husband-wife-chapman-bank-400m-sale-matches-fashion

[9] https://www.iamstobbs.com/opinion/strategies-for-constructing-a-domain-name-registration-and-management-policy

This article was first published on 14 May 2024 at:

https://www.iamstobbs.com/opinion/ip-and-digital-due-diligence-constructing-a-domain-policy-that-matches-brand-owner-requirements

A new analysis of the newest new-gTLDs

As the new-gTLD programme - the ICANN initiative to add a large number of new domain extensions (top-level domains, or TLDs) to the Internet - continues to see ongoing launches of new TLDs, we conduct a new retrospective of the activity landscape of the most recent extensions to have been launched. This new study focuses on all new-gTLDs to have entered their Sunrise or General Available periods since the start of 2023, following a previous overview by Stobbs of the full new-gTLD landscape^[1].

As of 01-May-2024, there are 20 new such extensions, listed in Table 1, which also shows the total number of domains (N) currently registered across each extension, and the mean entropy of these sets of domains. Domain entropy (measured using the second-level domain name (SLD) - i.e. the part of the domain name to the left of the dot - in each case) provides a measure of the amount of information, or randomness, in the domain name string. Previous studies looking at this parameter have shown that high-entropy domain names (i.e. those typically featuring long, random strings or characters) are often associated with automated domain registrations and fraudulent or malicious use^[2].

TLD	Sunrise start date	General Availability start date	N	Mean SLD entropy
lifestyle	24-Jan-2024	-	431	2.801
vana	24-Jan-2024	-	55	2.403
living	24-Jan-2024	-	570	2.741
diy	24-Jan-2024	-	475	2.644
food	24-Jan-2024	-	1,584	2.639
meme	20-Sep-2023	05-Dec-2023	9,115	3.327
ing	20-Sep-2023	05-Dec-2023	39,133	3.374
music	11-Sep-2023	-	175	2.483
box	09-Aug-2023	-	2,914	1.783
case	05-Jun-2023	04-Aug-2023	-[3]
dad	02-Apr-2023	10-May-2023	5,788	3.316
esq	02-Apr-2023	10-May-2023	4,775	3.418
foo	02-Apr-2023	10-May-2023	5,487	3.261
nexus	02-Apr-2023	10-May-2023	3,776	3.326
prof	02-Apr-2023	10-May-2023	1,597	3.278
zip	02-Apr-2023	10-May-2023	34,597	3.385
mov	02-Apr-2023	10-May-2023	8,505	3.409
phd	02-Apr-2023	10-May-2023	3,907	3.333
watches	28-Mar-2023	07-Jun-2023	267	2.555
channel	03-May-2022	01-Jun-2023	603	3.386

Table 1: Overview of the 20 new-gTLD extensions to have entered Sunrise or General Availability since the start of 2023^[4,5]

Overall, there is no meaningful correlation between the time since launch and the numbers of registered domains (Figure 1), suggesting that the rate of uptake of new registrations varies significantly between the extensions (presumably depending on factors such as availability, cost, and use-case).

Figure 1: Comparison between numbers of registered domains and number of days since start of Sunrise period, for the 20 newest new-gTLDs

The dataset includes a number of extensions previously highlighted as providing significant potential for fraudulent use - specifically .zip, .mov and .box^[6], which present the possibility for confusion with filename suffixes or brand names. Of these, it may be of concern that .zip has shown such a high rate of uptake. .ing is also noteworthy as the extension with the greatest overall number of registrations. This particular new-gTLD has a number of potential use-cases, given its generic nature as a word suffix, but also due to the fact that it presents the potential for fraudulent or deliberately deceptive use (including as an attack vector for bitsquatting^[7]). Some of the extensions have seen very limited levels of activity to-date, including .music^[8], which has specific application requirements for potential registrants.

No obvious overall trends are apparent from the analysis of domain-name entropy; .box shows the lowest average entropy of all of these extensions, but all of the remainder show mean values in a relatively consistent range between 2.4 and 3.5.

An analysis of the distribution of (SLD) lengths of the registered domain names across these new extensions (Figure 2) also reveals some interesting trends.

Figure 2: Distribution of SLD lengths of registered domain names across the 20 newest new-gTLDs

The most striking feature is the very large peak in numbers of registrations at a SLD length of 32 characters (58,759 domains in total). This same feature has been noted previously in analyses of specific extensions^[9], and appears often to be associated with visually apparently random SLD strings, comprising probable automated registrations (and potentially concerning use). Indeed, the majority of these 32-character domain names occupy a range of high entropy values (Figure 3) (potentially unsurprisingly, given the string length, but consistent with the SLDs featuring large numbers of distinct characters, rather than comprising more 'ordered' domain names).

Figure 3: Distribution of entropy values amongst the set of 32-character SLD domain names

Overall, new-gTLDs have previously been noted as being disproportionately favoured by infringers and showing high levels of abuse of various types^[10]. As a proxy for the overall brand infringement landscape, it is informative to consider the subset of domains across these new extensions with names containing the names of any of the top ten most popular global brands^[11]. In total, there are 427 such domains within the dataset. Many of these do not currently resolve to any significant content (but would warrant further monitoring), or resolve to pages indicating that the sites have been monetised through the inclusion of pay-per-click links or offers of sale of the domain name. A small number also re-direct to the official sites of the brands in question. However, there are instances of active potential brand infringements (Figure 4).

Figure 4: Examples of potential infringements targeting any of the top ten global brands, from the overall dataset (top to bottom: betvisa[.]meme; mcdonalds[.]ing; appleferretai[.]meme)

It is also noteworthy (as referenced in a recent Stobbs article on Web2/Web3 'crossover'^[12]) that various brand terms have already been registered on the .box extension, a TLD which offers dual Web2/Web3 functionality. Indeed, tencent[.]box, cocacola[.]box. coca-cola[.]box and mcdonalds[.]box all resolve to similar live websites displaying content relating to cryptocurrency and NFTs.

Amongst the longest domains in the overall dataset (115 examples with SLD names longer than 32 characters), there is a large group of domains with SLDs of the form 'qastaff-kw-autotestAAA-170XXXXXXXXXX' (18 on the .diy TLD, 16 .food, 11 .ing, 16 .lifestyle, 16 .living, 5 .meme). Whilst none currently resolves to any significant content (with the majority displaying Namecheap 'whois verification pending' pages), they clearly represent a coordinated set of registrations with potential for subsequent fraudulent or malicious use. There are also a number of domains which seem to serve no obvious purpose other than domain-name 'collectability' (as has also been observed in the blockchain domain ecosystem^[13]), with examples including daddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddaddad[.]dad, foofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoofoo[.]foo, 000000000000000000000000000000000000000000000000000000000000000[.]zip, and nothingelsematters-enter-sandman-metallicagirlsjustwannahavefun[.]zip (all 63 characters in length).

From this overall analysis we see that newly-launched gTLD extensions continue to attract significant volumes of activity, and should be a serious area of focus for brand owners. The relevant considerations cover two main areas: the first is the importance of a proactive brand-protection programme, incorporating the ability to monitor for third-party activity across the new range of extensions and to carry out timely enforcement against identified infringements; the second consideration is the opportunity to register official domains on these new-gTLDs, encompassing both core and tactical domains (for use in association with current or planned future business operations), and defensive registrations held to prevent third-party abuse. In light of the ever-decreasing availability of short memorable domain names across the popular legacy extensions^[14], new brand owners may wish to explore these new TLDs for their primary website presence. This is particularly relevant given the new round of applications scheduled to launch in 2026^[15] for which a dedicated website (https://newgtldprogram.icann.org/en) has recently been launched by ICANN^[16]. During this new phase, brand owners may even wish to consider to apply to run their own dot-brand extension^[17], giving them full control over all domains on that TLD, and making the creation of effective infringements by bad actors a much more difficult prospect.

References

[1] https://www.iamstobbs.com/opinion/expert-.watches-.new-.online-.website-.news-.lol-a-review-of-the-current-state-of-the-new-gtld-programme

[2] https://circleid.com/posts/20230703-an-overview-of-the-concept-and-use-of-domain-name-entropy

[3] Zone-file data unavailable 

[4] https://tld-list.com/launch-schedule

[5] https://newgtlds.icann.org/en/program-status/sunrise-claims-periods 

[6] https://www.iamstobbs.com/opinion/un-.zip-ping-and-un-.box-ing-the-risks-associated-with-new-tlds

[7] 'The world of the bitsquat', forthcoming Stobbs e-book

[8] https://www.iamstobbs.com/opinion/music-to-brand-owners-ears

[9] https://www.iamstobbs.com/opinion/the-randomest-domain-names-entropy-as-an-indicator-of-tld-threat-level

[10] https://circleid.com/posts/20230117-the-highest-threat-tlds-part-2

[11] https://www.kantar.com/inspiration/brands/revealed-the-worlds-most-valuable-brands-of-2023

[12] https://www.iamstobbs.com/opinion/the-crossover-two-recent-developments-in-web2/web3-interaction 

[13] https://www.iamstobbs.com/trends-in-web3-ebook

[14] https://www.iamstobbs.com/availability-of-domains-ebook

[15] https://www.iamstobbs.com/opinion/the-new-new-gtlds

[16] https://www.icann.org/en/blogs/details/icann-launches-new-gtld-program-website-01-05-2024-en

[17] https://www.iamstobbs.com/opinion/a-review-of-the-current-state-of-the-new-gtld-programme-dot-brands

This article was first published on 7 May 2024 at:

https://circleid.com/posts/20240507-a-new-analysis-of-the-newest-new-gtlds

RDRS - A slight un-darkening of the domain-name whois landscape?

^[1,2] Since the introduction of the General Data Protection Regulation (GDPR) (a European Union policy relating to information privacy) in May 2018, it is frequently the case that the domain ownership information given in whois (registration) records is significantly limited. This raises difficulties in identifying points of contact for the sending of enforcement notices in response to identified infringements and, furthermore, in the ability to be able to cluster together related findings to provide stronger indications of bad-faith activity and allow efficient bulk takedowns. 

The introduction of the Registration Data Request Service (RDRS), a new pilot scheme by ICANN (the Internet Corporation for Assigned Names and Numbers), to allow registrant data for gTLD domains to more easily be requested by entities with a legitimate interest, may mediate this situation to some degree. Whilst it was already previously possible to approach registrars to request information of this type, RDRS promises to put in place a simplified and standardised methodology. 

RDRS is intended to supersede the pre-existing Registration Data Access Protocol (RDAP) used for looking up public whois data through ICANN, which itself offers support for internationalisation and provides secure access. Currently for requesting non-public data, it is necessary to perform a look-up of the registrar responsible for managing an infringing domain, and then contact that registrar directly according to their communication preferences. With RDRS, however, requests can be submitted through a standardised form accessible through the user's ICANN account. The system then connects the requestor to the relevant ICANN-accredited registrar, who then ultimately makes the decision as to whether the information should be released, based on the grounds specified. RDRS does not therefore guarantee access to the registration data, and subsequent communication between registrar and requestor is carried out outside the system.

Participation in the system is voluntary for ICANN-accredited registrars, but who are strongly encouraged to opt in. RDRS launched in November 2023, with 56 registrars opting in through early onboarding, and with another 30 having subsequently joined, meaning that the scheme currently covers just over half of all gTLD domains. In cases where a request is submitted for a domain managed by a non-participating registrar, the system will still return a PDF document with all information required to submit the request directly to the appropriate registrar through the legacy process.

Use of the RDRS system is available to any entity with a legitimate interest in non-public gTLD domain registration data, including law enforcement, consumer organisations, and IP-protection, brand-protection and cybersecurity service providers. The system also provides functionality for uploading relevant documentation, such as court orders, and provides an option for requesting an 'expedited' review. It connects the requestor to the relevant registrar, but does not provide a means of contacting the registry (the organisation responsible for overseeing the whole TLD) and also does not support requests for domains on restricted extensions (such as .gov or .mil) or for domains registered under privacy-protection or proxy service providers. 

During the pilot period, ICANN is collecting usage data and other metrics, to allow a formal decision on the next steps for the scheme to be made. Relevant statistics are published on the ICANN website^[3] on a monthly basis. The most recent report^[4] covers the period until the end of March 2024, and includes a number of relevant insights, including the following points (covering the full dataset since the start of the RDRS pilot):

• To date, 1,007 disclosure requests have been submitted through the system. 360 cases have involved subsequent use of the 'export PDF' function for the data request form, in instances where the request pertains to a non-participating registrar.

• 2.5% of requests utilised the 'expedited review request' function.

• The most popular categories of requestor are: IP holder (36%), 'other' (21%), law enforcement (11%), consumer protection (9%) and security researcher (7%). 

• 20% of requests were approved by the registrar and 70% denied, with the remainder either not relevant because data is publicly available anyway (9%) or 'partially approved' (1%). The most common grounds for denial were: 'cannot disclose due to applicable law' (30% of cited denial criteria); 'other corrective action is first required' (27%); and 'request is incomplete / more information is required' (19%). 

• The average response time is 5.3 days for approved requests and 3.3 days for denied requests. 90% of responses are received within 16 and 7 days (for approved and denied requests, respectively). 

• The report lists all 86 registrars currently opted in to the RDRS scheme (p. 16 of the report). 

The relatively high denial rate for requests submitted in the RDRS pilot to-date raises concerns that the scheme may not prove as useful to brand owners as had been hoped; RDRS leaves the final decision on disclosure in the hands of registrars and will not necessarily change their position. For example, in Stobbs' experience^[5], US registrars generally redact registrant data due to GDRP and will refuse to provide it (even through RDRS) unless subpoenaed. The compliance rate through RDRS is lower than for the comparable scheme run by Nominet for .uk domains (for example), which also uses a dedicated form. Overall, it is possible that UDRP (Uniform Domain-Name Dispute-Resolution Policy) may still transpire to be the most effective route for unmasking redacted information in many cases going forward. However, it is significant that these developments are taking place at a time when domain registrars are coming under increasing scrutiny in response to the Registrar Accreditation Act (RAA)^[6], requiring them to take action in cases where DNS abuse is detected. 

References

[1] https://international.eco.de/event/rdrs-how-to-access-whois-data-today/ 

[2] https://livestream.com/accounts/686369/eco-rdrs/videos/244594844 

[3] https://www.icann.org/rdrs-en 

[4] https://www.icann.org/en/system/files/files/rdrs-usage-metrics-15apr24-en.pdf 

[5] S. Ustel, pers. comm., 02-May-2024

[6] https://www.icann.org/resources/pages/global-amendment-2024-en 

This article was first published on 2 May 2024 at:

https://www.linkedin.com/pulse/rdrs-slight-un-darkening-domain-name-whois-landscape-david-barnett-5xuyf/

A summary was also published on 27 June 2024 at:

https://www.linkedin.com/posts/stobbs_rdrs-activity-7212106221485531136-Rr7B

Key facts about the GlobalBlock scheme: a consideration for domain management and online brand protection clients

by David Barnett and Daniel Smith-Juggins

Introduction

Third-party registration of domains incorporating the name of a trusted brand or trademark can be a key type of infringement of concern, and can form the basis of a number of types of brand attack, including phishing, brand impersonation, or false claims of affiliation.

Many programmes exist to help protect brand owners from these types of infringing activity, of which one familiar example - created in response to the launch of the new gTLD (generic top-level domain) programme in 2012, where the number of available domain-name extensions (TLDs) was vastly increased - is the Trademark Clearing House (TMCH)^[1]. Through this scheme, brand owners were able to submit their trademarks for validation, granting them automatic rights to register the trademark as a new domain name upon the launch of a new TLD, and receive notice of any (exact-match) applications by third parties. A number of individual registry operations (the entities responsible for overseeing individual extensions) also launched similar programmes, such as the Domain Protected Marks List (DPML) blocking scheme^[2], originally offered by the Donuts organisation which ran several of the new-gTLD extensions.

The GlobalBlock programme

The GlobalBlock service^[3] is a similar brand protection initiative which launched in 2024, allowing brand owners to block (at a registry level) the registration of all available domain names matching the brand name, whilst allowing them the option to unblock and register domains for their own use. It is run by the Brand Safety Alliance^[4,5], an initiative of GoDaddy Registry. The related 'GlobalBlock+' option also covers 'lookalike variations' (i.e. typos and homoglyph variations^[6]), such as those commonly used in phishing and other types of brand abuse. The scheme covers over 500 domain extensions (a mixture of gTLDs, new-gTLDs and ccTLDs - i.e. country-specific extensions)^[7], and also includes a number of other features^[8], including:

• The ability to 'automatically capture' matching domain names previously owned by third parties, once they become available (i.e. adding them to the brand owner's blocking 'account', though not putting them under ownership) (‘Priority AutoCatch’).

• Catching domains if accidentally expired or deleted ('Automatic Domain Assurance').

Several major extensions (such as .com, .net, .org, .fr and .eu) are (currently) not covered by the programme. However, the scheme does include some territories in which registration is normally subject to eligibility criteria (e.g. .mc (Monaco) and .gi (Gibraltar), and .io (British Indian Ocean, but popular with use by technology companies). The list is not definitive, and it is likely that more extensions will be covered by the GlobalBlock scheme over time, which will convey additional advantages for brand owners.

Brand owners can subscribe to the GlobalBlock scheme by purchasing through an 'accredited agent', which includes a range of major domain-name registrars, and with the cost being dependent on the provider.

Other key points:

• In general, any organisation or individual can purchase GlobalBlock if they have a protected IP right (such as a trademark, company or organisation name, or a celebrity name). Protectable terms must be at least three characters in length^[9].

• The scheme also incorporates a dispute resolution policy, which may be employed by an accredited agent or applicant whose verification application has been denied, or a third party challenging the approval of a verification application^[10].

• In cases where several brand owners with identical trademark rights subscribe to GlobalBlock, and one of the holders wishes to release a domain name for use, the release must be accepted by all GlobalBlock holders of the same brand.

• GlobalBlock can be purchased in 1-, 2- or 3-year periods, with renewals also available for the same periods.

• Brand owners are able to transfer the GlobalBlock service between accredited agents, with the transfer request adding an additional year to the life of the service.

• If a brand owner has already verified their rights through any of a number of pre-existing schemes (AdultBlock, DPML, MPML, dotXXX Sunrise B (SRB) Registration), purchase of GlobalBlock is generally possible without repeating the verification process.

• Current users of AdultBlock or DPML have early access to the GlobalBlock 'Founders Discount Program' (until 31 May 2024), offering a lower price, and giving the option to convert a DPML expiring before the end of February 2025 into a GlobalBlock (or purchasing 'bridging protection' for later-expiring DPML memberships, for those extensions not covered by the DPML).

Key take-aways

GlobalBlock is a powerful offering for brand owners looking to augment an existing brand protection solution. However, it is not a substitute for a full programme, as wildcard variants (i.e. domains featuring the brand name plus any additional keywords) are not covered, and still need to be addressed through classic monitoring and enforcement approaches. It is also an important consideration following analysis of the findings from a domain audit or registration policy construction. In general, GlobalBlock is likely to be a more significant option for larger brand owners with greater potential for third party infringements, and those with a presence (or planned presence) in a wider range of geographical territories (reflected by the range of ccTLD extensions covered by the scheme).

References

[1] https://newgtlds.icann.org/en/about/trademark-clearinghouse

[2] https://www.trademark-clearinghouse.com/content/donuts-dpml

[3] https://globalblock.co/

[4] https://brandsafetyalliance.co/

[5] https://globalblock.co/faq/

[6] https://www.iamstobbs.com/idns-ebook

[7] https://globalblock.co/included-extensions/

[8] https://globalblock.co/key-features/

[9] https://globalblock.co/wp-content/uploads/2023/12/BSA-GlobalBlock-Eligibility-Policy-1.1-1.pdf

[10] https://globalblock.co/wp-content/uploads/2023/12/BSA-GlobalBlock-Dispute-Resolution-Policy-1.0-1.pdf

This article was first published on 1 May 2024 at:

https://www.iamstobbs.com/opinion/key-facts-about-the-globalblock-scheme-a-consideration-for-domain-management-and-online-brand-protection-clients