Industry View | Battling Brandjackers

MarkMonitor's CSO Ihab Shraim offers strategies against domain kiting, pay-per-click abuses and other attacks on your brand

By Ihab Shraim, MarkMonitor

While brand abusers and criminals can be located anywhere, the geographic distribution of sites hosting brand abuse demonstrates a consistent trend throughout 2007: The U.S., Germany and the U.K. lead all countries with 68 percent, 9 percent and 4 percent of domains hosting abuse, respectively.

Brandjackers have begun to target more mainstream packaged goods including food and beverages, automotive products, and consumer goods. In fact, the biggest growth in brandjacking abuse during 2007 was in mainstream product categories, such as automotive with an 83 percent increase and food and beverage products with a 67 percent increase. Overall abuse continued to rise by 31 percent. We have begun to observe "blended abuse" whereby pay-per-click and fraudulent phishing pop-up ads have been combined to lure unsuspecting prey.

The good news is that domain kiting and PPC activity has dropped off. Kiting threats actually dropped in the last quarter, and were below levels observed at the beginning of 2007. The same was observed for pay-per-click attacks.

There are several reasons for these decreases. First, a number of highly-publicized lawsuits and large damages sought by Microsoft, Dell and Verizon to protect their brands may have had an effect on the most abusive and permissive domain registrars. By using both cybersquatting and counterfeiting laws against domain abusers, these leading brands have 'upped the ante,' making the practice far less attractive from a financial point of view. Next, the more desirable keywords for paid searches are getting more expensive, and both Yahoo and Microsoft MSN are making it more difficult for these kinds of abuses. Finally, ICANN has increased its scrutiny of these practices, bringing greater industry attention to these abuses. With the recent announcement by Google that it will turn off Ad Sense revenue for domains that are younger than six days old, kiters should see a further significant drop in their revenue streams.

Still, kiting has been profitable: Industry sources mention that one kiter received more than $3 million in pay-per-click revenues, and this for sites that never had to pay for their domain names!

The recent proposal by ICANN to institute a 'restocking fee' for domain name registrations may cut into kiters' profits, further decreasing the practice. However, as long as there is money to be made, we can be sure to see the practice continue.

The recent news on phishing continues to be worrisome. Phishers are carefully picking the most desirable targets. During the last quarter of 2007, there was profound growth in the number of new organizations targeted by phishers, with 122 companies observed for the first time as the subjects of an attack. This is the biggest increase in any quarter of the year, showing that the phishers are widening their focus. We also saw seasonal shifts in the types of target industries, and continued increasing sophistication in the types of exploits used by phishers to obtain individual user account information.

• Print

• That's Gonna Leave a Mark
• A Case for Anticounterfeiting
• 5 Ways Google Is Shaking the Security World