News

What you need to know for domain name protection

In today’s digital world, there are very few large companies without an online presence, and for any company that relies on consumers, a website is essential for survival.

Top priority for most Australian businesses is to get .com.au. But that’s only the first of many steps you need to take to ensure your customers can quickly and reliably reach you online.
The domain name landscape has become enormously complex, and there are many issues you need to deal with to ensure your customers can find you online. Here are the most important ones.

Secure country top-level domains

Having secured your .com.au domain name, the next step should be to secure the same, or as near as possible, name in other country top level domains (TLDs) where you operate, .co.nz, for example.
Today, in addition to these country TLDs, there are hundreds of other generic top level domains (gTLDs), and the list is growing all the time. This includes industry specific names such as .aero and .archi that are restricted to organisations in those industries, and many others that anyone can use to create their domain name. Some, such as .attorney, are clearly intended for organisations of a certain kind, but are actually available to anyone.

The Internet Corporation for Assigned Names and Numbers (ICANN), the global Internet oversight body, lists hundreds presently available and says over 1300 new gTLDs could become available in the next few years.
For the uninitiated, keeping up with developments and determining which names would be useful or important to have can be very challenging.

 

Protect your domain names with trademarks

There is also the challenge of proactively protecting your business names online. Simply having a business or company name offers you no protection from somebody with a legitimate right to use a similar or identical name from registering it. Only a trademark will give any protection.
Here’s how the system works. ICANN has created a database of validated and registered trademarks to help trademark holders prevent their trademarks being used as domain names by others.

It applies only to second-level domain names and, in particular, is designed to prevent trademark infringing names from being registered under the many new gTLDs. Holders of valid trademarks that are listed with the clearinghouse are notified before new gTLDs become available and given the option of purchasing names that correspond to their trademarks.
In the first 90 days after a new gTLD goes live, anyone trying to register a name is informed if that name matches a trademark registered with the clearing house. If they proceed to register it, the trademark owner is notified.

The trademark owner would then have no certainty they would be able to prevent their name being used by its now owner. They can negotiate with ICANN, but this is a difficult and time-consuming process that requires expert assistance.

A healthy domain name market

An easier, and possibly cheaper option might be to simply buy the name from the registrant. There is a healthy market in domain names, with specialist sites auctioning names. Some names have changed hands for eye-watering amounts. Lasvegas.com was bought in 2015 for a reputed $US90 million ($A127m).

Famous names like that have obvious value. If you want to buy an obscure name that happens to match your business name or that of your product or service, you can often pick it up quite cheaply, unless the seller realises why you need it.

Do you have these answers?

Protecting your brand online should be a high priority, but to do this effectively, you need to be very proactive in an area that is not core business and requires considerable expertise and knowledge. Are you across all the domains that your organisation owns? Do you know when they need renewal? Are the details attached to these domains all up-to-date? Do you have a strategy to protect your trademarks?

Don’t have the full answers to the above-mentioned questions? The solution is to outsource your domain name management to a specialist domain management service for which all these tasks represent core business.

A good corporate domain manager will have the systems and the qualified personnel to look after all aspects of your domains efficiently and reliably. In addition to protecting your brand online, a domain manager will take care of the routine aspects of domain management, ensuring details lodged with domain registrars are correct and appropriate, and that all domains’ registrations renew automatically.

An effective corporate domain manager will even negotiate to buy domain names on your behalf, so the seller does not realise why they are wanted and jack up the price.

If you’re interested in finding out more about specialist domain name management, please contact Melbourne IT.
Our MITC team have been helping large Australian businesses effectively manage their domains since 1996.

Most businesses today are well aware of the need to protect their business assets from online threats, but one vital asset gets very little attention in many businesses: the portfolio of domain names.

A business can suffer significant damage if it becomes uncontactable online. In some cases, it could cause reputational damage. In a worst-case scenario, a business focussed on trading online could cease to exist. Here’s how that can happen and what you need to do to avoid it!

Forgetting to renew

Domain names are often set-and-forget assets. Once they are registered, unless changes are required, no further action is needed until they are due for renewal, usually several years after registration.

This is by far the most common domain name error, and some of the biggest names on the net have suffered the consequences.

Foursquare started life as a local search-and-discovery mobile app and is now a global online brand. It allowed registration of Foursquare.com to lapse in 2010 due to a ‘billing glitch’ with their domain registrar.

In 2013 customers of two UK banks, Clydesdale Bank and Yorkshire Bank, were locked out of their online accounts because their owner, Australia’s NAB, forgot to renew the domain name for its group name server, nabgroup.com, that directed requests for those websites to the correct destinations.

In 2003 Microsoft forgot to renew the domain name hotmail.co.uk, and someone purchased the domain. The buyer then tried to contact Microsoft to offer them the name but he was ignored. Only when news site The Register contacted Microsoft almost two weeks later to ask why someone else owned their domain did they take notice and recover it.

Not renewing names you might not need can also be damaging. Heinz used fundorado.com for a competition in 2013 and 2014. The site was reached by scanning a QR code on ketchup bottles. When the competition ended Heinz let the name lapse and by 2015 it had been registered by a porn site. The Heinz customer who discovered that took to social media to tell everybody.

Domain hijacking

Not all domain dangers are due to accidental mishaps. Domain names are registered with domain registrars who hold all the details of the domain including account authorities, and name server information associated with the domain.
Once someone has access to your details held by your domain registrar, for example through a phishing exercise directed at the legitimate contact, they can take full control of your online presence.

Things are made easy for them because, in many cases, the email address of the legitimate contact is publicly accessible via a query to whois.com.

Domain hijacking is also facilitated by some registrars having insufficient security practices relating to corporate domain management.

Some, but not all, offer registrants the ability to implement a security lock. This allows only one person to make changes to registration details, and that person must complete two-factor authentication to do so.

You should only use a domain registrar that provides this facility, and make sure it is activated, but many businesses fail to do this.

83% of the Forbes Global 2000 companies are at risk of domain name hijacking because they have not adopted basic domain security measures like the registry lock protocol.
And if the hijacker has transferred the name to a registrar in another country, retrieval could require legal proceedings in that country, a costly and protracted exercise.

Hijacking on the rise

To make matters worse, the Spamhaus Project, an international non-profit organisation that tracks spam and related cyber threats, says domain hacking is on the increase.

And in 2018 the Australian Cyber Security Centre (ACSC) alerted Australian businesses to “a global Domain Name System (DNS) infrastructure hijacking campaign”. It directed organisations to its Essential Eight mitigation strategies to protect their systems.

A full domain hijacking where access is lost, or where users are directed to another site, is likely to be rapidly detected, hopefully enabling, speedy remediation. Potentially more damaging is a hijack that enables the attacker to direct only selective requests to another site.

This happened last year to Japanese cryptocurrency exchange Coincheck. The hackers gained access to registration details for coincheck.com and changed the nameserver to their own, with a very similar name. This enabled them to let most of the traffic go to coincheck.com, reroute some to their own look-alike website and launch phishing attacks on those unsuspecting coincheck.com customers.

The solution? Specialist management

A good way to reduce your exposure to these dangers and to help implement robust protection for your entire domain name portfolio is to outsource management to a dedicated corporate domain management service.

If you’re interested in finding out more about specialist domain name management, please contact Melbourne IT. Our Domain Portfolio Solutions team have been helping large Australian businesses effectively manage their domains since 1996.