A Review of the 2024 Threat Landscape and Implications for Domain Security

The cybersecurity landscape in 2024 has been characterised by unprecedented complexity and rapidly evolving threats, presenting significant challenges for organisations across all sectors. As the digital attack surface expands and threat actors employ increasingly sophisticated techniques, domain security has emerged as a critical component of a robust cybersecurity strategy. more

Availability Analysis of Brandable Variant-String Domain Names

For any entity looking to launch a new company or other initiative, a primary requirement is often the selection of an appropriate brand name and the acquisition of a relevant associated domain name. In light of the increasing shortage of short, unregistered memorable names on popular domain name extensions (TLDs), many organisations are choosing to adopt novel or invented brand names and/or consider the use of alternative TLDs. more

Further Ideas in Mark Similarity Measurement

In the final three articles in my series looking at algorithms for measuring the similarity of marks, I extend the ideas to provide a more sophisticated and adaptable framework. Article 4 introduces a similarity score based on color distance in RGB space, offering a quantitative approach to trademark similarity. Article 5 refines word mark similarity by using the International Phonetic Alphabet to improve phonetic analysis. The final article presents a method for sorting colors by dominant shade, aiding in trademark review and potential guidelines for color mark protection. more

Further Developing a Word Mark Similarity Measurement Framework

Expanding on a framework for quantifying word mark similarity by examining algorithms and proposing enhancements. This article assesses consistency with UK trademark case decisions and a search tool, explores subsequence analysis for similarity, and suggests using IPA phonetics to measure aural likeness. The objective framework could improve consistency in trademark assessments, despite the inherent subjectivity of legal tests. more

Further Developing a Colour Mark Similarity Measurement Framework: Building a Database

In my recent article on mark similarity measurement, I discussed a possible framework for protecting colour marks. The framework involves the specification of each colour according to its RGB (red-green-blue) specification (in which each component is expressed as an integer value between 0 and 255), with the suggestion that the protection afforded by a colour trademark could incorporate not only this exact colour, but also all similar colours around it up to a certain 'distance'... more

Towards a Quantitative Approach for Objectively Measuring the Similarity of Marks

Central to many intellectual property disputes is an assessment of the degree of similarity of two contested marks. A determination of similarity is fundamentally a subjective decision involving a range of relevant tests, which include consideration of the perception of the relevant consumer and recognition of the existence of degrees of similarity within a spectrum (from high to low). more

Unregistered Gems Part 4: Other Brandable Domain-Name Styles

In the fourth in this series of articles exploring how the application of appropriate tools, algorithms and analysis techniques can identify the existence of attractive, unregistered brandable domain names, I consider the prevalence of a few additional styles of name. more

Unregistered Gems Part 3: Keeping Your -ize on the Prize

The previous two articles in this series have outlined techniques for 'mining' brandable domain names -- that is, domain names of potential interest to entities looking to launch a new brand name and associated website -- from the enormous dataset of unregistered names (determined via zone file analysis). The key element of the identification process is the implementation of filtering techniques to identify... more

Further Explorations in Brandable Domain Names: Sensational Spellingz

My previous article on brandable domain names1 -- that is, available (unregistered) domain names which may be appealing to any entity looking to identify a potential name for a new brand launch -- focused on the use of phonotactic (i.e. 'readability') analysis techniques to identify candidate names. more

Unregistered Gems: Identifying Brandable Domain Names Using Phonotactic Analysis

Conventional wisdom within the domain-sales industry states that the stock of unregistered domain names is 'running out,' with limited or no availability of short, desirable domain names across popular extensions (TLDs). This presents problems for would-be brand owners looking for a brand name (and accompanying suitable website presence) to utilize for newly-launched companies... more

An Unnatural .Bond: A Study of a ‘Megacluster’ of Malware Domains

A recent news story, following research from security provider Infoblox, highlighted the case of the 'Revolver Rabbit' cybercriminal gang, who have registered more than half-a-million domains to be used for the distribution of information-stealing malware. The gang make use of automated algorithms to register their domains, but unlike the long, pseudo-random ('high entropy') domain names frequently associated with such tools, the Revolver Rabbit domains instead tend to consist of hyphen-separated dictionary words (presumably so as to obfuscate their true purpose), with a string of digits at the end. more

Exploring the Domain of Subdomain Discovery

Domain name monitoring - that is, the detection of domains with names containing a brand-term (or other string) of interest - is a very well-established element of brand protection services. Branded domain names are of key importance to brand owners (as the basis for business-critical infrastructure (i.e. 'core' domain names), and as part of a 'tactical' portfolio of strategic and defensive registrations), but also to infringers, who can utilise domains as a means of impersonation, passing off, claimed affiliation, or traffic direction and monetisation. more

A New Analysis of the Newest New-GTLDs

As the new-gTLD programme - the ICANN initiative to add a large number of new domain extensions (top-level domains, or TLDs) to the Internet - continues to see ongoing launches of new TLDs, we conduct a new retrospective of the activity landscape of the most recent extensions to have been launched. This new study focuses on all new-gTLDs to have entered their Sunrise or General Available periods since the start of 2023, following a previous overview by Stobbs of the full new-gTLD landscape. more

An Overview of the Concept and Use of Domain-Name Entropy

In this article, I present an overview of a series of 'proof-of-concept' studies looking at the application of domain-name entropy as a means of clustering together related domain registrations, and serving as an input into potential metrics to determine the likely level of threat which may be posed by a domain. more

The ‘Millennium Problems’ in Brand Protection

As the brand protection industry approaches a quarter of a century in age, following the founding of pioneers Envisional and MarkMonitor in 1999, I present an overview of some of the main outstanding issues which are frequently unaddressed or are generally only partially solved by brand protection service providers. I term these the 'Millennium Problems' in reference to the set of unsolved mathematical problems published in 2000 by the Clay Mathematics Institute, and for which significant prizes were offered for solutions. more

Patterns and Trends in Domain Tasting of the Top 10 Global Brands

Domain tasting is a long-established practice involving the short-lived existence of a domain, which is allowed to lapse a few days after its initial registration. The practice arose in response to an Internet Corporation for Assigned Names and Numbers (ICANN) policy allowing a domain to be cancelled -- with all fees refunded -- within a five-day grace period, intended to address the issue of accidental registrations1. However, the practice is open to abuse by infringers. more

The Highest Threat TLDs - Part 2

In the first article of this two-part blog series, we looked at how frequently domains were used by bad actors for phishing activity across individual top-level domains (TLDs) or domain extensions, using data from CSC's Fraud Protection services, powered by our DomainSecSM platform. In this second article, we analyze multiple datasets to determine the highest-threat TLDs, based on the frequency with which the domains are used egregiously for a range of cybercrimes. more

The Highest Threat TLDs - Part 1

A domain name consists of two main elements: the second-level domain name to the left of the dot - often consisting of a brand name or relevant keywords - and the domain extension or top-level domain (TLD) to the right of the dot. Domain names form the key elements of the readable web addresses allowing users to access pages on the internet and also allowing the construction of email addresses. more

The Continued Rise of Phishing and the Case of the Customizable Site

We’ve noted in previous CSC studies that phishing continues to be an extremely popular threat vector with bad actors and shows no signs of subsiding in part, because of the COVID–19 pandemic and the rise in popularity of remote working. Indeed, the most recent figures from the Anti-Phishing Working Group (APWG) show that the numbers of phishing attacks are higher than ever before, with the quarterly total of identified unique phishing attacks exceeding 1 million for the first time in Q1 2022, and over 600 distinct brands attacked each month. more

Four Steps to an Effective Brand Protection Program

Internet use has become ever more pervasive. With around five billion global users, it generates an economy of around 15% of global gross domestic product (GDP); that's around $15 trillion and is a figure that's growing 2.5 times faster than GDP itself. This makes the internet an attractive channel for infringers. Phishing and other fraud tactics, selling counterfeit goods online, and digital piracy are primary areas of concern. more

Registration Patterns of Deceptive Domains

A key requirement for a bad actor wanting to launch a brand attack is the registration of a carefully chosen domain name. The most convincing infringements frequently use a domain name that's deceptively similar to that of the official site of the target brand. This allows a variety of attacks to be executed, including phishing attacks... more

Do You See What I See? Geotargeting in Brand Infringements

Geotargeting is a well-established online technique for delivering tailored web content based on a user's geographic location. From an internet technology point of view, this is usually based on the user's IP address, which is converted to a physical location through a standard look-up process performed by network infrastructure. Geotargeting is commonly used by websites for several legitimate reasons, including providing users with relevant advertising and other content... more

Branded Domains Are the Focal Point of Many Phishing Attacks

As a long-established online attack strategy, phishing remains a popular tool for fraudsters because of its effectiveness. The Anti-Phishing Working Group reported more than 300,000 distinct phishing attacks in December 2021 -- more than three times the number reported in early 2020, and the highest monthly total ever identified. more

Breaking the Rules on Counterfeit Sales: The Use of Hidden Links

Counterfeiting is big business. A 2021 study by the Organisation for Economic Cooperation and Development (OECD) estimated that the international trade in counterfeit and pirated products was worth up to $464 billion in 2019, or around 2.5% of all world trade. A significant proportion of this trade occurs via digital channels, where global annual expenditure on eCommerce is more than $4 trillion. more

The World of the Subdomain

A web domain name is the foundational piece of internet property allowing its owner (registrant) to construct and host an associated website. On a domain, the owner is also able to construct whatever subdomains they wish -- a process that is technically achieved via the configuration of records on the authoritative domain name system (DNS) server. more

Domain Registrations Associated with New TLD Launches

One of the central goals of a brand protection program is detecting infringing third-party activity that falls outside the firewall - that is, external to a brand owner's portfolio of official core and tactical domains. Brand threats occur across a range of internet channels, but domain name abuse is one of the most significant areas for concern, both in terms of the visibility and potential for confusion of branded domain names by potential customers, and the enforcement options available. For this reason, domain monitoring is considered a core component of a brand protection service. more

Euro 2020 Part Three: Domains (Revisited) and Other Channels

In this final article in the series of studies looking at Euro 2020-related infringements, we revisit domain name infringements and consider activity across other online channels, with a focus on social media and mobile apps. Following the original study, which looked at domains registered before May 2020 with names containing "euro2020" or "euro2021," we analyzed daily activity levels in the period immediately preceding and during the competition. more

Euro 2020 Part Two: eCommerce Marketplace Activity

Following our previous article on the Euro 2020 football tournament that looked retrospectively at domain name registrations relating to the competition, this article considers activity on eCommerce marketplaces. For this study, our Discovery Engine technology was used to conduct a regular series of scans across key international online marketplaces. We monitored for listings (offers of sale) relating to Euro 2020 clothing and merchandise. more

Euro 2020: An Illustration of the Link Between Real-World Events and Online Infringements

In the run-up to the postponed Euro 2020 football championships, we've analyzed historical registration trends in domains containing the terms "euro2020" or "euro2021." A number of previous studies -- looking at events as diverse as the COVID pandemic, the annual holiday season shopping events, and the Reddit campaign relating to the manipulation of the stock price of U.S.-based retailer GameStop -- show a link between real-world events and spikes in online activity. more

Phishing Scams: How to Spot Them and Stop Them

Phishing scams are nothing new in the online security world and show no signs of subsiding. The scam starts when a fraudster sends a communication purporting to originate from a trusted provider and encourages the recipient, often with a conveyed sense of urgency, to click a link. That link leads to a fake site, usually intended to collect confidential login credentials or other personal information. In similar scams, the mail may encourage the recipient to open an attachment loaded with malicious content. more

Brand Abuse and IP Infringements – Part 2: Enforcement and Return on Investment

In the first article in this two-part series, we looked at the impact of brand abuse and infringements against intellectual property (IP) on an organization's brand value. In this second article, we delve into how action against enforceable infringements can deliver tangible return on investment (ROI) for a brand, and demonstrate the importance of a robust brand protection program. more

Brand Abuse and IP Infringements – Part 1: Brand Impact

In this two-part blog series, we take a closer look at brand abuse and intellectual property (IP) infringements. In this first article, we explore the components making up a company's IP and how online content can affect a brand's value, both actual and perceived... The IP held by an organization -- i.e., the portfolio of brands, trademarks, and other intangible assets that provide it with its distinctiveness, and protect it from unfair competition in the marketplace... more

A Cautionary Tale of Reputation Damage: Striking the Right Balance With Brand Protection

In early March 2020, a well-known European fashion brand found themselves on the receiving end of a protest campaign on social media. The background to the case was the fact that, in 2019, the brand had launched a cease and desist (C&D) action against a small, U.K.-based company in response to their use of similar product names and sale of associated clothing merchandise. more

Coronavirus Online Threats Going Viral, Part 5: Social Media

For our final blog in this series, looking at the online risks associated with COVID-19, we focus on social media. The popularity of social media channels means that they are extremely susceptible to exploitation by cybercriminals and other infringers, particularly during the coronavirus crisis. In an earlier post in this series, we discussed the use of social media for the distribution of phishing-related content, but CSC has also noted marked activity relating to the creation of fake accounts. more

Coronavirus Online Threats Going Viral, Part 4: Phishing

In part four of this series of posts looking at emerging internet content relating to coronavirus, we explore phishing. In times of crisis, cyber criminals invariably take advantage of the growing concerns of the public. In the case of the coronavirus, they have done so by sending phishing emails that play on the fears surrounding the spread of the illness. A number of reports have emerged of emails purporting to provide advice or assistance relating to COVID-19... more

Coronavirus Online Threats Going Viral, Part 3: Mobile Apps

In part three of this series of posts looking at emerging internet content relating to coronavirus, we turn our attention to mobile apps - another digital content channel that can be used by criminals to take advantage of people's fears about the health emergency for their own gain.One of the most common attack vectors we have found in our analysis is the use of apps purporting to track global progression of COVID-19, or provide other information, but which instead incorporate malicious content. more

Coronavirus Online Threats Going Viral, Part 2: Marketplaces

In the midst of the coronavirus crisis and the partial or total quarantines happening around the world, more people are turning to eCommerce for their purchases. This, combined with the increased demand for healthcare and healthcare-related products, is causing surges of activity on online marketplaces. Perhaps least surprising is the growth in the number of listings for cleaning and hygiene products (e.g., hand sanitizer), as well as facemasks... more

Coronavirus Online Threats Going Viral, Part 1: Domain Names

As news of the spread of the coronavirus (COVID-19) continues to emerge, CSC has undertaken the first in a series of studies looking at how the development of the crisis has affected online content. This first article looks at the numbers of registered domains with names containing coronavirus-related strings - "coronavirus" or "covid(-)19" (optional hyphen) - and analyzes the types of content present on the associated websites. more