Introduction
It’s rarely defined in writing, but every online brand protection strategy includes a relevance threshold that must be met before resources are allocated. Applied to domain names, this threshold is defined by answering questions like: If my brand is relatively unknown in this country, do I need to register the brand-match domain under its ccTLD? What are the odds that that an Internet user would mistake this typo domain as legitimately belonging to my company?
When applied to established domain name extensions, the brand owner has access to plenty of data to evaluate the impact of a potential defensive registration: The popularity of the extension (number of active domains), information on cost and restrictions that may deter bad-faith registrations, and the existing levels of abuse can all be studied. The launch of new top-level domains complicates the decision, as it’s unknown at first how popular the extension will become, or whether the original set of restrictions will maintain over time.
New extensions that are not part of the ICANN-managed DNS add another wrinkle, as the brand owner must consider whether the underlying domain name system will gain a level of acceptance significant enough to warrant threat mitigation efforts. “Alternative DNS roots” have been around since the early 1990s and rarely have they risen to the level of usage to garner the attention of brand protection specialists.
Blockchain domains have entered the public consciousness to an extent that previous alt-root projects have not, leaving brand owners wondering what degree of attention needs to be paid to this space.
This text will focus on blockchain domain names offered through Ethereum Name Service (.eth, .box) and Unstoppable Domains (.x, .crypto, .nft etc.), organizations that each claim 2-2.5M active domains. It will attempt to answer the standard set of questions that a brand owner would face when deciding whether to add any other domain name to a defensive portfolio.
What is the intended use of these domains?
In a cryptocurrency transfer, the payer must input the “address” of the recipient. The standard format of these addresses are very long, alphanumeric codes. Domain names offered through Ethereum Name Service (ENS) and Unstoppable Domains can serve as a shortener for these codes. In practice, this means that for one user to request a payment from another, providing an identifier like “mydomain.crypto” is sufficient and the long code is not needed.
Additional functionalities include the use of the domain as a username in supported apps, as well as the option to create a website, by which “mydomain.crypto” can resolve to content uploaded by the user to a special hosting service, so long as the website visitor is using a browser that can resolve these domain name extensions (Chrome, Firefox and Edge cannot).
Are big brands doing anything with these domains?
To answer this question, we reviewed news articles and press releases about purchases of alt-root domain names by large companies. Next, we reviewed a selection of apps to discover if a profile had been created by the brand, using the acquired domain. Finally, we attempted to resolve the domain in the Opera web browser, which supports many of these domain name extensions.
Initial queries aimed at generating a list of brands that had acquired alt-root domains returned several articles with some combination of the same five brands: Budweiser, Gucci, Nike, Puma and Adidas. The domains acquired by these brands were our sample for this exercise.
Granted there have certainly been many additional registrations that skipped the press release, we feel confident in the conclusion that brand activity in this space is relatively low. Note that domains belonging to public figures were excluded from these searches.
Also noteworthy in this stage of the review was the fact that each brand announced its registration under the same domain name extension: .eth, operated by ENS.
The use case of domain name=profile username was observed for each of the five brands names. Likewise, the use of the profiles reviewed was the same in each case: A portfolio of NFTs related to the brand was displayed for review and purchase.
None of the .eth domains mentioned in news articles resolved to a website in the Opera browser.
Is there a risk of abuse?
A search for practically any famous brand in a marketplace for alt-root domains (ex. OpenSea) will come up with several domains for sale. The obvious conclusion here is that users with no connection to a given brand are registering domains matching that brand in the hopes of reselling at a profit.
Apart from bad-faith registrations, there are few reports of alt-root domains being used for abusive purposes. The usual blueprint for using domains for phishing and fraud doesn’t apply at this early stage of adoption, considering how few of these domains are used for websites and email.
If we enter the realm of the theoretical, a few possible scams can be imagined:
- A prominent member of the cryptocurrency community reported on X that scammers had registered an .eth domain matching his long, alphanumeric address (think: 0x225f137127…, but with .eth at the end). The scam works when the user inputs the correct address in an exchange platform (without the .eth at the end) and the alias domain (with the .eth) appears as the first result. The user that intended to transfer to the holder of the long, alphanumeric address instead transfers to the scammer that registered the .eth domain. How could this apply to brands? It’s a stretch, but this scenario could apply to any company that instructs its clients to transfer cryptocurrency directly from their accounts and not through a payment gateway.
- Recall that the brands that were reported to have acquired an .eth domain were each using it to display and sell NFTs. This presents a more plausible scam possibility, namely that a third-party could register a brand domain, link it to a marketplace that sells NFTs, then produce digital art consistent with the brand’s image and attempt to sell the NFT as if it were produced under the brand’s supervision.
What measures can be taken to mitigate abuse?
Unstoppable Domains has joined GlobalBlock, a blocking service that prevents registration of domain names matching trademarks over a wide selection of extensions, mainly those in the DNS. When a brand name is searched on Unstoppable Domains, some results come up as “Protected” and cannot be purchased normally. There is a form to be completed on the website by the trademark owner to request the release of the domain.
ENS is not part of GlobalBlock nor other blocking services, but does display a similar message when the user searches a famous trademark: “Online registration for this domain is unavailable. Please contact the registry directly for further information.”
In both cases, the sample brands queried appeared to have been blocked only after the domain name extensions were made available to the public. Both in Unstoppable Domains and ENS, searches for famous brands produced a mix of “protected” and “registered” results. Among such results, we were able to observe some “registered” domains available for purchase on the OpenSea marketplace.
Neither Unstoppable Domains nor ENS has a defined dispute mechanism, nor a web form to request domain name transfer or deletion on trademark grounds. When a trademark-matching domain name is already in the hands of an unaffiliated third party, the most receptive party to trademark complaints are the marketplaces on which these domains are sold. OpenSea has a history of executing takedowns and has a process in place to receive these requests from representatives of trademark holders.
Conclusion and Recommendations
Blockchain domains meet the relevance threshold based on two criteria: Many domains have been registered and a good portion of these are bad-faith registrations. The risk level is “medium” for the time being, as the legitimate use of these domains by brands is so low that a member of the public would not reasonably attempt to use them as a primary means to access brand content. Only when this level of adoption occurs would bad actors dedicate more resources to fraud, thereby moving the risk level to “high.”
The most cost-effective measure that can be taken is to find out whether the brand’s name is available to register at ENS and Unstoppable Domains and if it is not, then search on OpenSea and other marketplaces to find out if the domain names are for sale by their current owners. The .eth domain name extension should be given priority for acquisition, as both individual users and brands have adopted this extension more than any other in this category. Note that even very famous brand names under .eth can be found for under 1.000 USD.
GlobalBlock is a cost-effective service for brands that might otherwise pay to register their name under many different TLDs for defensive purposes. If a brand was considering GlobalBlock anyway, the inclusion of Unstoppable Domains should be a strong factor influencing the decision to contract this service.
Marketplace takedowns on OpenSea or other platforms on which blockchain domains are sold is an option with a reasonable chance of success, but which addresses only the potential that a third party might profit from the sale of domains based only on their association with the brand. Delisting only complicates sale, but does not often lead to domain deletion or transfer.
