In my experience on campaigns large and small, domain management is too often been an afterthought. This is unfortunate because proper domain planning can really help the success of a campaign just as a lack of planning can harm a campaign. Domain stewardship isn’t difficult and it attaches naturally to the creative process.

Online Brand Stewards Should Control Domains

Who is the proper steward of a brand online? The client? The ad agency? The interactive agency? There are many POVs about who “owns” a brand online.

As marketing stretches into corporate strategy, sales, service and support, it becomes more than visual identity and messaging in traditional media. Arguably, some measure of brand ownership actually transfers to the public because of the distributed self-investment of social media.

Online brand stewardship is currently relative to a blend of talent, resources, capabilities, experience and expertise within a particular client-agency partnership. Depending on the mix, brand control would clearly fall into one camp, or it might be a joint responsibility with each party assuming specific roles.

Regardless of who stewards the brand online, one party should assume ownership of the brand’s roster of domains.

Domain Management for Small Businesses

When I started my own web development company in 1997, I used to register domains for my clients. I stopped this practice by 2000 because I found it to be a taxing deviation from my primary service. I spent too much time tracking down old clients, getting renewal approvals and collecting money for domains I paid for, but didn’t own.

I also wasted a lot of time tracking down old web developers and hosting partners who had registered my client’s name in their own name. In most cases, I’d have to convince a dejected former partner to hand me the domain keys. In some cases I encountered old vendors who wouldn’t release the domain without receiving payment on an unrelated service, a form of blackmail domainjacking. Consequently, I registered domains on behalf of my clients using their credit cards.

Today, small hosting companies and web developers can turn to broad suites of automated hosting tools to help them run their business. These tools handle everything from lead gen to automated POS, server administration, and of course, discounted domain registration.

Still, I encounter considerable domain management risk all too frequently. Registration and administration is abdicated to the most technically savvy people on the team.

Good domain management involves more strategy than production. Many domain managers are intimidated by the technicalities of domaining, but they really just need to approve a clear domain strategy. The plan can easily be executed by an interactive producer or brand domainer.

As interactive media matures, I foresee a greater dependency on a unique service discipline: the Brand Domainer. This person or company would monitor domaining trends and would consult with agencies and clients on procurement. Domaining and brand registration is a critical duty in interactive campaigns, yet this responsibility is currently dispersed between IT, marketing & production groups and across client, agency, developer and hosting companies.

The Brand Domainer fulfills these roles:

• Domain Procurement & Maintenance
  Stakes out and maintains Registrar partnerships for generic, sponsored and country code TLD registration & transfers. Marks timely payments to avoid downtime and tightly controls DNS administration across all brands.
   
  The idea of a “Digital Safe Deposit” can be useful for interactive ad campaigns, especially flights across multiple platforms (social media, SaaS, Web 2.0, DNS, hosting, etc). With dispersed talent & high turnover between client/agency/interactive/partner companies, account authentication & digital assets are at risk.
• Domain Consultation & Recommendations
  Make recommendations on domain names based on availability, creative work, domaining budget and risk of domainjacking threat.
• Social Media Consultation & Profile Registration
  Make recommendations on social media platforms based on creative work and risk of domainjacking threat. Register profiles and maintain a master list of access points for brand agents and community managers.
• Domaining Budget
  Forecast and maintain domain registration budgets based on procurement plan and length of agreements.
• Brand Monitoring & Policing
  Use RSS & monitoring tools like Google Blog Search, Radian6, TweetBeep and UsernameCheck.com to passively intercept threats. Actively query and patrol search engines and popular social media platforms for brand abuses.
   
  Protectors of very large brands already pursue brand infringements, at least passively. I have a good friend who took his site down after receiving a Cease and Desist letter from McDonalds. This was for a .nl Netherlands domain that simply began with “Mc.” Either some poor legal IT intern found his obscure domain while scouring the web through a dictionary search (black helicopter active), or his online brand promotion was so successful that he sprang up on a staffer’s radar (passive interception)
   
  Note, brand monitoring describes preventative activities for brandjacking and domainjacking. This is distinct from listening, measuring and analyzing social media for ROI, strategy or engagement, more accurately defined as Analytics.
• Domain Dispute Resolution
  Command a working knowledge of the ICANN Dispute Resolution Policy; a domainjacking mandates a rapid response. Refer to the Domainjacking Primer for advise on what to do if you’ve been domainjacked.
• Social Media Dispute Resolution
  Most social media platforms currently do not publish dispute resolution policies. Brands with trademarks and service marks likely have a case for account termination or transfer. However, at this time, prevention through pre-launch registrations is recommended.
• Legal Liaison
  Maintain awareness of legislation like the Snowe Bill that impacts the domaining industry. Follow dispute resolution briefs such as the Fairwinds’ list of brandsucks complaints.

Brand Domaining As a Vendor Solution

If anyone is poised to successfully launch this new kind of service, it’d be a large ICANN registrar like GoDaddy, Register.com or Network Solutions. A smaller registrar might also consider this play as a means of generating properties through large bulk registrations.

Interactive shops or hosting companies could provide brand domaining as a flat pass-through cost to large and small agencies that are stretching interactive resources. I can also conceive of a new SaaS company carving a lucrative niche practice in this space. Profilactic.com is a social media agreggator/lifestreaming service that promised to help people with “identity crisis.”

In either case, the should become an Accredited ICANN Registrar capable of registering its own Top Level Domains (TLDs). This would make the registration of domains less expensive so campaigns could acquire massive domain batches.

Domain management is an important part of brand stewardship; I think clients and agencies would appreciate the peace of mind from a partner that made this a painless component of their interactive campaigns.

As part of my Domainjacking Primer, I want to share my own experiences in “gettin’ punk’d” by a domainjacker. Hopefully I can help other online brand managers avoid or respond to this kind situation.

The Dastardly Domain Thief

i worked on a national campaign that invested heavily in product development, brand identity and advertising production for months before the official launch. We attracted millions of impressions via PR, TV, radio, direct and online media. Everyone considered the campaign a success.

Unfortunately, within days of launching the campaign, a domain squatter managed to register an odd non-premium generic domain. This person slapped a fake website together to deliberately confuse our target for their own profit. Operating from a foreign country, they sold a knock-off product using our brand equity.

To make matters worse, they launched their own Adwords campaign and directly competed in search media. Our trademarked brand and its keyword variants initially had low usage, so the squatter could snag niche keyword inventory at a very low CPM. However, their “competitive” keyword grab boosted the inventory value, complicated our SEO efforts and made SEM more expensive for our campaign.

By capturing a fraction of our search traffic, they clearly intended to profit from PPC AdSense revenue given the ads plastered throughout their site. In no time flat, we faced public confusion and brand dilution from someone piggybacking our large investment and months of hard work.

Domainjacking Mandates a Swift Response

Fortunately, we responded so quickly that the brand ultimately only suffered mere annoyance. Working through cease and desist letters, we procured the rapid cooperation of the squatter’s registrar and hosting company. We reclaimed rightful domain ownership and even enjoyed brief AdSense exposure at the squatter’s expense.

Following this episode, we developed a comprehensive domain management policy that purchases large blocks of domains. There is now tighter DNS coordination between agency account management and client IT management in the run-up to new campaign launches. And following a campaign launch, the agency and client actively patrol for new infringements against their brands.

Avoid Domainjacking with Proper Planning

In addition to this overt case of domainjacking, I have encountered all kinds of problems from poor domain stewardship. I’ve had to wrest DNS info from former web developers and hosting companies, help track down lost passwords from old employees and rescue domains from botched international transfers. Each of these cases could have been avoided.

These experiences motivated me to write this series on brand stewardship and domainjacking avoidance. Today, I utilize several tools on ad campaigns to help with domain registration, DNS account management, social media profile management as well as engagement analytics.

Speaking of brandjacking, here is the “ALL YOUR BASE ARE BELONG TO US” vid, a 4-minute mash-up of old viral memes. Lots of mileage from this mix-tape.

Best Practices in Domain Management

Having produced scores of integrated interactive campaigns, I have seen unexpected problems arise from improper domain and social media account management.

I want to share my experience and offer advice on domainjacking, a risk that can be particularly detrimental to brands.

What is Domainjacking?

Jump to a section below
What is Domainjacking?
Types of Domainjacking
What Domainjacking Is Not
How to Defend Against Domainjacking
How to Respond to a DomainjackingDomainjacking^* is a bold type of brandjacking where domainjackers co-opt a brand’s identity and goodwill in bad faith at the point of domain registration. Domainjackers aim to steal traffic for personal profit or to smear a brand. They use search engine marketing and organic search results to generate profit in the form of PPC ad revenue and/or sales of similar products and services.

Unlike phishing scams that prey on victims through broadcast spam email, domainjackers build websites using branded domain names. Using SEM/SEO, brandjacked social media profiles, and conceivably through phishing, they drive traffic to their illicit sites.

Consequently, search engines are constantly adjusting their algorythms to avoid driving traffic to illegitimate domains. Social media platforms will need to implement Dispute Resolution Policies as brandjacking becomes more prevalent and as social media becomes more important to brands.

Types of Domainjacking

Here are a few examples of domainjacking, either by malicious parties or brand stewardship incompetence. Some tactics are illegal, some may not have a legal precedence.

• Alternate TLD Registrations
  Many interactive campaigns only register the most popular top level domains like .com, .org and .net. A domainjacker often sweeps in to buy other TLDs like .info, .biz as well as country code TLDs like .us and .uk.
• Similar Names
  Domainjackers may register domain misspellings, similar spellings or phrases with the brand name embedded.
• Domain Disputes
  Small business marketing services companies like web developers, graphic designers and former employees have been known to hijack a domain they registered on behalf of their brand client for nonpayment of services.
• “BrandSucks.com” Gripe Sites
  Vindictive and aggrieved customers may register a brandsucks site in order to voice their complaint or publicly trash a brand. In these cases, brand managers have to file official UDRP complaints with ICANN in order to affect site termination or transfer.
   
  Internet strategy consulting firm Fairwinds Partners maintains a list of UDRP brandsucks complaints, their outcomes and ICANN’s decision. Note many complaints did not rule in favor of the brand complainant. (Hat tip to IPKat’s Law Blog for links and opinions in this area.)
• Outright Domain Theft
  Domainjackers may use a variety of methods to acquire access to a brand’s registrar account. With this information, a domainjacker could transfer ownership or temporarily redirect traffic to an alternate web server.

What Domainjacking Is Not

When trying to define what something is, it’s helpful to define what it is not.

• Domaining
  Domaining is a multifaceted multibillion dollar industry involving domain sales, management, brokering, auctions and link generation. One can find successful “domainers” in the “domainersphere” who’ve profited from legitimate domain trading.
• Legitimate Domain Ownership
  Domainjacking is not the legitimate transfer of domain ownership nor is it the legitimate aquisition of a domain following its term expiration. “Domain squatters” utilize software to grab domains when they expire and brand managers may be forced to bid on those domains in the open marketplace if they cannot demonstrate bad faith on behalf of the new registrant.
• Lost Registrar Passwords
  In order to prevent domainjacking, registrars have numerous checks in place to verify domain administrators are who they say they are.
• Registrar Parking
  Registrars can park domains on their own servers for nonpayment.
• Phishing
  Phishing is a malicious type of brandjacking that preys on customers of a brand. This tactic is usually executed via spam email that asks the recipient to click on a bogus link to enter personal account information. The fake landing page often has branded subdomains and a similar visual identity intended to confuse and deceive.

How to Defend Against Domainjacking

To the extent a team can anticipate threats, domainjacking is largely avoidable.

• Don’t be cheap
  Domain registration is a nominal cost of a campaign, but it can be a significant line item. Be prepared to explain the cost of not properly managing domain registrations in terms of harm to the brand, lost revenues, lost engagement opportunities, legal fees, misplaced resources, etc.
• Mark Your Brand
  Where appropriate, get a trade or service mark on your brand. This won’t prevent DNS registration, but it will help support registrar domain disuptes and convincing hosting companies to comply with ceast and desist requests.
• Perform a Simple Risk Analysis
  Start a list of domains ranked by high, moderate and low risk threats of domainjacking. This list would be considerate of the project’s domaining budget, media plan and forecasted impact. Popular brands should register all TLDs appropriate for a campaign. Read my Domain Checklist For Interactive Campaigns when planning & registering domains.
• Avoid Social Media Brandjacking
  Invest time to register brands with popular social media & micromedia account profiles. Jeremy offers an excellent list of Brands that got Punk’d by Social Media. Follow my Social Media Checklist For Interactive Campaigns as a minimal social media strategy.
• Register with a Generic DNS Admin
  When registering a domain, use a generic email account like dnsadmin@brand.com. Not only does this help control privacy of domain ownership, but you also remove your dependency on individual staff. When the producer or DNS manager leaves your company, you don’t need to go searching for passwords or log into your registrars to change all the contact. You can simply auto-forward the generic DNS admin accounts to a new account. Take care not to jeapordize security in this handoff.
• Manage Domain Passwords
  This duty usually falls into the realm of the Interactive Producer, however, online brand stewards should take care to safeguard this content from the risk of threat. Resource managers may also consider assigning all domaining duties to a single Brand Domainer.
• Long Registration Periods and Auto-renewals
  All registrars allow domain managers to registrar domains for extended periods of time. This can actually help SEO because search engines trust long-term domains more than those nearing expiration. Set accounts to auto-renew domains to prevent unintended expiration. Be sure to keep credit card info up to date with the registrar.
• Lock Registrar Accounts
  Most registrars now allow account managers to lock the domain accounts to prevent accidental account changes.
• Register Your Own Brandsucks Gripe Site
  “Sucks” and “stinks” are two common pejoratives in brand bashing. BrandChannel distributes a whitepaper on managing the destructive potential of brandsucks: The Power of Internet Gripe Sites. One notable example is the film theater chain Loews. The registered LoewsSucks.com and use the site as a customer feedback channel with its Guest Satisfaction Survey. Fairwinds Partners maintains a list of 100s of brands that have registered their own brandsucks domain name.

How to Respond to a Domainjacking

If you’ve been domainjacked, you need to mobilize your team and respond swiftly to limit damage to your brand. Here are a list of actions.

• Know Your Enemy
  Perform a Whois search to determine who registered the domain and where it is hosted. Note, the domainjacker may have made this info private to thwart your effort, but you will be able to determine their registrar and the IP address of the host server.
• File a UDPR with the ICANN Registrar
  ICANN publishes their Uniform Domain-Name Dispute-Reolution Policy or UDPR that is followed by all registrars. Here are considerations that help complainants win a favorable ruling.
   
  Trademark and Service Mark
  Demonstrate use of, or demonstrable preparations to use, the domain name in connection with a bona fide offering of goods or services. Note, weak and nonexistent trademark claims, aka reverse domainjacking, can harm a brand.
   
  Commonly Known
  Demonstrate being commonly known by the domain name, even if you never acquired trademark or service mark rights.
   
  Noncommercial Fair Use
  Demonstrate how the domainjacking either a) intends to mislead or divert customers, b) tarnishes the trademark or service mark or c) is not a noncommercial or fair use of the domain name.
   
  Even with an airtight claim and amid a customer service crisis, Panix, the oldest ISP in New York, faced crippling battles with MelbourneIT and Verisign when their email traffic got domainjacked.
• Lawyerup and Counterpunch
  Attorney jokes are to Americans as Aggie jokes are Longhorns, but this is the time you want aggressive legal counsel in the are of Intellectual Property rights and domain management.
• Attack on Multiple Fronts Simultaneously
  Send Cease and Desist letters to the registrant and to the hosting company. The sites are commonly self-hosted in a foreign country, so be sure to follow the ICANN domain dispute process and contact the hosting company directly.

In my next article, I will share my own own experiences on domainjacking.

Footnotes
^* I love the English language because we can easily meld words to form new phrases without disrupting transmission. I prefer “domainjacking” over “domain jacking” or “domain-jacking” because a precendent has been set with “carjacking.” (OT: I once got carjacked in Oak Cliff near Dallas; ask me about it sometime.)

And for you SEO and domaining ninjas, I hope you appreciate my not-so-subtle effort to capture some alternative spelling traffic! In case your wondering, and so that I might mention the keyword just one more time, here are some domainjack conjugates (and their current Google results). I’ll spare you the H1 tag wraps

Clients, agencies and interactive production shops can use this this TLD checklist when registering top level domains for a specific campaign. This list is helpful for domain planning and for domainjacking avoidance.

» Last Modified October 6, 2008
» # of Platforms 81

Generic TLDs

Nearly all campaigns merit registration of all Generic TLDs.
.biz
.com
.info
.name
.net
.org
.pro

Sponsored TLDs

Registration of these domains is limited to specific conditions.
.aero
.asia
.cat
.coop
.edu
.gov
.int
.jobs
.mil
.mobi
.museum
.tel
.travel

Commercial, Vanity and Domain Hack ccTLDs

Brands may utilize some of these popular country code TLDs. They may also build domain hacks that combine subdomain and TLDs for clever or shorter domains (i.e. del.icio.us).

.ad – advertising
.ag – agriculture
.am – AM radio, audio, podcasts, domain hacks
.be – domain hacks
.cc – carbon copy
.cd – Audio, podcasts, file sharing
.dj – Audio, podcasts, file sharing
.fm – FM radio, audio, podcasts
.gg – social gaming, gambling (gg = good game)
.im – instant messaging, domain hacks
.in – Internet, domain hacks
.it – Internet, domain hacks
.je – “You” in Dutch and “I” in French
.la – Los Angeles, domain hacks
.li – Long Island, domain hacks
.lv – Las Vegas, love
.md – medical doctor
.me – individuals
.ms – Microsoft projects
.mu – music, audio
.nu – “New” in English, “Now” in Dutch
.sc – source
.st – street
.to – Toronto, domain hacks
.tv – broadcast, entertainment, online video
.ws – website
.vu – “View” in English, online video
.vg – video games, advertainment

TLD References

IANA
ICANN
Historical TLDs
Generic TLDs (gTLDs)
Sponsored TLDs (sTLDs)
Country Code TLDs (ccTLDs)
List of Current IANA TLDs