Patent Grant
7756987
A typo-squatter refers to a type of cybersquatter that registers one or more typographical variations of a well-known domain name. For example, a typo-squatter may register “microsft” as a domain name in an effort to capture Internet traffic from a person that mistypes the domain name “microsoft”. In addition to typographical variations, some cybersquatters register domain names for combination terms such as “microsoftoutlook”, which includes a company name and trademark (MICROSOFT®) along with another trademark owned by the company (OUTLOOK®). Various exemplary technologies are described herein to discover cybersquatters and to manage information related to such cybersquatters to enhance security and, in general, to enhance a user's browser experience. In particular, various technologies aim to uncover large-scale and systematic cybersquatters.
An exemplary method includes providing a typographically erroneous domain name, tracing the domain name where tracing includes entering the domain name as a part of a URL and recording one or more subsequent URLs, identifying a domain parking service for the domain name based at least in part on information in one of the recorded URLs, determining client identification information in at least one of the recorded URLs where the client identification information identifies a customer of the domain parking service and blocking one or more domain names based at least in part on the client identification information. Other exemplary technologies are also disclosed.
Non-limiting and non-exhaustive embodiments are described with reference to the following figures, wherein like reference numerals refer to like parts throughout the various views unless otherwise specified.
Use of various technologies described herein demonstrates that a large number of typo-squatting domains are active and that a large percentage of these typo-squatting domains are parked primarily with a few domain parking services. These domain parking services serve syndicated advertisements on typo-squatting domains. In some instances, syndicated advertisements include adult content. Serious concerns arise where such content appears upon entry of a typographical variation of child-oriented website's domain name. Various exemplary technologies allow a parent to protect a child's web browsing activities, allow a website owner to systematically monitor cybersquatting activities against a website, etc.
The realm of the cybersquatting industry 160 includes questionable domain name registrars 172, questionable web hosting companies 174, questionable domain parking services with contextual ad infrastructure 176 and domain parking services powered by other entities 178. For example, the parking service “sedoparking” provides a domain parking service, but it serves ads from another entity. In another example, an entity may have its own domain parking service that serves its own ads.
While conventional ad syndicators serve relevant contextual ads, for example, based on a publishers' web content, domain parking services serve ads based on domain name alone (e.g., in many instances parked domains have no content). Many cybersquatters take advantage of domain name parking infrastructures to perform large-scale, systematic cybersquatting.
The cybersquatting industry 160 relies on payments by advertisers 140. Various scenarios illustrate how money can flow in the cybersquatting industry 160. For example, to access potential consumers, advertisers 140 enter contracts with domain parking services 176, 178, usually on a payment per click basis. In turn, the domain parking services 176, 178 attempt to maximize clicks through deals with any of variety of entities including cybersquatters 170. Cybersquatters 170 may pay for registration of questionable domain names by domain name registrars and pay for hosting of such domain names with web hosting companies 174 of questionable reputation and business practices. A cybersquatter 170 is an entity that owns or otherwise controls a questionable domain name.
While many domain name registrars are not involved in cybersquatting practices, those that are involved are deemed questionable (questionable domain name registrars 172). A questionable domain name registrar may also be a cybersquatter 170. In general, registrars are accredited by ICANN or another official body. Questionable registrars 172 risk having their accreditation revoked.
Conventional advertisement syndication relies on instructing a client-side browser application to fetch ads from an ads server and to compose the fetched ads with content of a website that a user intends to visit. In such a manner, some type of legitimate association between ad content and website content occurs. For example, an advertiser of automobile insurance may want to display ads on a website for automobile aficionados.
Advertisement syndication typically relies on a third-party URL mechanism of a web browser application. Such a mechanism operates via instructions received when a user visits a primary URL (hosted by the first party) either by typing the primary URL into the browser address bar or by clicking on a link (e.g., on a web page, in an email document, in a general document, etc.). For example, a primary URL page may contain instructions that cause the browser application to automatically visit one or more secondary URLs hosted on third-party servers (e.g., to retrieve additional content such as images). Often, such instructions occur without explicit knowledge or permission from a user. While many secondary URLs are on the primary URL's corresponding first-party domain server, some secondary URLs hosted on third-party servers, such secondary URLs are referred to as third-party URLs. Third-party URLs usually contain information about the primary URL to allow syndicators to serve the most relevant contextual ads based on the primary URL page's content (and potentially historical information about the visiting machine or user).
As already mentioned, domain parking is a special case of advertisement syndication. In domain parking, a primary URL is a parked domain name without any real content. Instead of a web page with meaningful content, a parked domain name displays to a user a web page with syndicated ads, usually in the form of ad listings.
As an example, consider a user that enters “disneychannell.com” via a browser application. This domain name instructs the browser application to load www.sedoparking.com/disneychannell.com, a URL responsible for serving a listing of domain-parking ads. In another example, the domain name “disnychanell.com” causes a browser application to load www.gimmie-games.com, a URL that advertises online games.
Some domain parking services provide additional information in third-party URLs that facilitates analysis. For example, when a browser visits disneyg.com, the response page contains a HTML frame that loads:
In this string, the “cid” field contains a Client ID that uniquely identifies a cybersquatter. As discussed herein, various exemplary techniques can use such information to discover typo domain names registered to well-known, serial typo-squatters.
Referring again to the infrastructure 160, domain parking services provide convenient and effective contextual-ads infrastructures that make even marginal typo domain names profitable. With an annual domain name registration fee being as low as $7.00, a parked typo domain name can usually cover this fee by attracting between one unique visitor every two days and two visitors per day (depending on the pay-out levels). In terms of scale, servers owned by two identified domain parking services reached between 3,300 and 5,200 per million users daily to achieve overall server traffic ranks between #221 and #438, numbers comparable to those for popular websites such as travelocity.com (#248), orbitz.com (#315), reuters.com (#342), usatoday.com (#347), and slashdot.org (#375).
The URL tracing technology 240 gathers information associated with URL redirection. For example, when a user visits a web site, a browser application may be instructed to visit other third-party domains without the user's knowledge. Some of the third-party domains can raise security, privacy, and safety concerns. The URL tracing technology 240 reveals the third-party domains. As shown in
The malicious URL evaluation technology 210 allows for detection and analysis of web sites hosting malicious code, in particular, code that exploits browser vulnerabilities. While various technologies discussed herein mention browsers, such technologies can optionally be used for detection and analysis of sites that provide any of a variety of types of web based content. For example, many media players can load additional lyrics and purchase information (e.g., as “web pages”) and are therefore potentially affected by exploits, etc.
A detection system known as the Strider HoneyMonkey Exploit Detection System has been developed by Microsoft Corporation (Redmond, Wash.). The HoneyMonkey system can detect attacks that use web servers to exploit unpatched browser vulnerabilities and install malware on computing devices of unsuspecting users. Such attacks have become one of the most vexing issues confronting Internet security experts.
Various conventional methods provide a “honeypot” server on the Internet to gain information about attacks and attackers. While manual analyses of exploit sites often provide useful, detailed information about which vulnerabilities are exploited and which malware programs are installed, such analyses do not provide a big-picture view of the problem.
The Strider HoneyMonkey system creates a “honeymonkey” (e.g., an automated honeypot on a computer or a virtual PC) that actively mimics the actions of a user surfing the web. Accordingly, a “monkey program” can drive a browser in a manner similar to that of a human user and run on one or more virtual machines to detect exploit sites.
The spam URL evaluation technology 220 can classify URLs as spam-related 225 by a context-based approach that analyzes URL redirection (e.g., using the URL tracing technology 240). As large-scale cyber scammers (e.g., spammers, etc.) create hundreds or thousands of doorway pages that either redirect to or retrieve ads from a single domain, spam URL evaluation technology 220 can help identify an entire spam operation by uncovering target pages that connect to a large number of doorways. More specifically, by feeding a list of known spam URLs to search engines to find forums, blogs and other pages where more such spam links are located, the spam URL technology can compile the links into a single potential spam URL list. The list can be provided to URL tracing technology 240 to find which domains are associated with a high volume of doorway pages. False positives can be reduced by checking URLs against a whitelist of legitimate ad and web analytics providers.
Accordingly, identification becomes easier as a spammer spreads a URL and once the spam URL evaluation technology 220 identifies a forum for spam, the forum essentially becomes a “Honey Forum” to obtain other spam URLs. Priority for manual investigation generally increases as the number of doorway pages increases. Identification of spam URLs 225 can be followed with either removal of the URLs from a search index or assignment of low relevance ranking to each of the URLs.
Cybersquatter URL evaluation technology 230 can identify cybersquatting URLs 235.
(A) Missing-dot typos: The “.” following “www” is removed, for example, wwwSouthwest.com, wwwBarbie.com, and wwwMySpace.com.
(B) Character-omission typos: Characters are omitted one at a time, for example, Diney.com, MarthStewart.com, and RuneSape.com.
(C) Character-permutation typos: Consecutive characters are swapped one pair at a time, unless they are the same characters, for example, Rueters.com, NYTiems.com, and Cingluar.com.
(D) Character-replacement typos: Characters are replaced one at a time and a replacement character is selected from a set of characters adjacent to the given character on a standard keyboard, for example, DidneyWorld.com, Luftgansa.com, and USATodsy.com.
(E) Character-insertion typos: characters are inserted one at a time and the inserted character is chosen from a set of characters adjacent to either of the given pair on a standard keyboard (and including the given pair), for example, Googlle.com, WashingtonPoost.com, and Mozzilla.org. This algorithm can also insert characters at the beginning and at the end.
The method 300 includes a scan block 320 that scans typo samples using tracer technology (e.g., URL tracer technology 240). Such scanning can operate a network of virtual machines on a host machine. When a list of typo domain names is dropped into a queue, a daemon process running on the host machine can fetch the list and launch virtual machines to visit each domain name in the list. To avoid interference due to ill-behaved pop-up ads and latent scripts, the daemon process can restart a new virtual machine from a pre-configured clean state before scanning the next domain name. Before destroying the previous instance of a virtual machine, the daemon process can copy relevant recorded data to the host machine. The recorded data may include all secondary URLs visited and their ordering, the content of all HTTP requests and responses, a screenshot, etc. Upon completing the scan of the entire list of domain names, the daemon process can copy relevant data to an output folder on the host machine. While virtual machines are mentioned, the method 300 may use one or more alternative approaches. For example, a set of isolated browser instances can be used where each instance processes a unique primary URL.
The method 300 includes a rank block 330 that ranks domain parking services using, for example, tracer technology (e.g., URL tracer technology 240) and a top domain name approach. A ranking process can use recorded relevant data (e.g., as stored in an output folder) for data queries and analysis. Types of analysis include:
(A) Given lists of typo domain names belonging to a defined category, an analysis can determine how heavily the category is being typo-squatted and can identify dominant participants amongst domain parking services.
(B) Given a target domain name, an analysis divides its typo domain names into ranked sets according to the number of domain names parked with each of the parking services. Information such as client ID and anchor domain name can be used to further divide and rank the sets in order to help the owner of the target domain name prioritize an investigation. An anchor domain can be used to aggregate traffic from multiple typo domain names to simplify operations and to enable scalable typo-squatting. For example, typo domain names “ComFedBnak.com”, “LaSalleBanl.com”, and “SovererignBank.com” share the same anchor “baankaccount.com”. In most cases, typo domain names sharing the same anchor domain name are registered to the same registrant according to the “Whols” database (Whols.com Pte, Ltd.); in other cases, anchor-based analysis allows for discovering domain name registrants that share the same postal address and that are most likely aliases of the same entity (e.g., company).
(C) For analyses that require searching for specific keywords (e.g., sexually-explicit keywords used in the analysis), an analysis of HTTP response pages occurs to extract all typo domain names that match a particular keyword or keywords.
The method 300 includes a rank block 340 for ranking domain parking service customers, for example, using client IDs in third party redirection URLs. As already mentioned, some redirection URLs include a “cid” field. More generally, some redirection URLs include a substring component that can be discovered and used to identify a client of a domain parking service. A particular example of this is the “cid”, which exists in many redirection URLs. As discussed herein, a substring can be any subcomponent of a redirection field and could even be a non-static value. Accordingly, the terms “cid” or “cid field” refer to any of a variety of possible substrings used for purposes of identifying an entity (e.g., a client of a domain parking service). A domain parking service may embed a client ID in a third-party redirection URL for purposes of accounting, process implementation, etc. Through analyses of information in a cid field, various patterns emerge. For example, cid field information has proven useful in identifying a particular cybersquatter as a client of a domain parking service.
Overall, the method 300 identifies domain parking services and/or customers of a domain parking service using particular techniques. In addition to the aforementioned techniques, various exemplary techniques described herein can identify domain parking services and/or customers of a domain parking service. Further, various exemplary techniques allow a user to gather information, analyze gathered information and/or block domain names based on such analyses.
Two particular exemplary techniques are referred to herein as vertical analysis and horizontal analysis. These two techniques can assess the prevalence of typo-squatting and identify domain parking services involved in typo-squatting. The vertical analysis uses a single type of typos for a large number of target domain names while the horizontal analysis uses multiple types of typos for a smaller set of target domain names.
In a particular example, the vertical analysis technique scanned missing-dot typos of the top 10,000 most popular domain names (as measured by an opt-in toolbar) and showed that 5,094 (51%) of the 10,000 typo domain names were active at the time of the scan. Typo domain name customers were linked with parking domain service providers based on ads served. The parking domain services were then ranked according to their respective number of typo domain names. From this analysis, two parking domain services covered approximately 40% of the active typo domain names and the top six parking domain services together accounted for more than half (about 59%) of the active domain names and about 30% of the artificially generated missing-dot typo domains.
In a particular example, the horizontal analysis was used to analyze two sets of target domain names: the first set consisted of 30 target domain names for popular sites and the second set consisted of 30 high-risk target domain names associated with phishing attacks. For each target domain name, the horizontal analysis scanned its typo-neighborhood composed of typo domain names generated from the five typo-generation models (A-E of block 312 of
As explained, the method 300 and various techniques can scan a large number of typo domain names, monitor third-party URL traffic, and group the domain names by behind-the-scenes domain parking service servers to facilitate further investigation. Further, some domain parking services provide additional information in their third-party URLs (i.e., secondary URLs) that can facilitate further analysis.
A horizontal analysis provided tens of anchor domain names. An analysis of traffic aggregation through these anchor domain names identified two client IDs used by a particular cybersquatter, one client ID for the typo domain names and the other client ID for the anchor domain names. The analysis continued by extracting all scanned domains parked with the identified domain parking service that used the two client IDs. Using a service known as “Whols” (Whols Pte, Ltd.), one may enter a domain name and identify the owner. For the horizontal analysis, “Whols” queries verified that almost all of the domain names were registered to the particular cybersquatter.
The cybersquatting technologies 400 are grouped loosely according to function. For example, the technologies 410, 412, 414, 416, 418, 420, 430 and 440 can be part of an exemplary browser application whereas the technologies 450 and 460 pertain to services for use by any of a variety of parties. Technologies 470 and 480 can uncover or police the Internet for cybersquatters and related practices while technology 490 pertains to proxy logs. Various technologies in
The browser history patrol technology 410 allows a user to re-visit one or more URLs as recorded in a browser history file while recording all third-party redirections. Thus a browser application may include a browser history patrol technology module that allows a user to re-visit one or more recorded URLs for purposes of identifying one or more URLs that may have been responsible for serving inappropriate content and/or responsible for installing a spyware program or another malicious program.
The secondary URL technology 414, the final destination URL technology 416 and the redirection URL technology 418 can be part of or otherwise supported by the browser history patrol technology 410. For example, a browser history patrol module 410 can classify information acquired during a re-visit to a recorded URL as pertaining to a secondary URL, a final destination URL and/or a redirection URL.
The browser URL analysis tool 412 may aid in such classifications based on particular characteristics of information acquired during a re-visit. For example, a browser URL analysis tool can search URL strings acquired during a re-visit to identify information such as client IDs. Such a tool may be implemented as a feature (e.g., an add-on feature or a built-in feature) of a browser application and it may be part of a browser URL history patrol module 410.
An exemplary browser application includes a browser URL history patrol module 410 that records information during an initial visit to a URL and/or during a subsequent visit to a URL. For example, an exemplary browser application can receive a user command to display a history of visited primary URLs. Upon clicking on a primary URL, the browser application can display one or more non-primary URLs associated with the primary URL. Such non-primary URLs may be color coded or arranged with respect to function (or perceived function). For example, for a given primary URL, non-final destination, non-primary URLs may appear in a one color while a final destination URL may appear in a different color (e.g., red). Further, such a display may provide a user with an opportunity to access one or more of the URLs (e.g., clicking on a URL).
With respect to accessing one or more URLs recorded by a browser URL history patrol module 410, an exemplary URL analysis tool 412 can create an instance of a secure virtual machine or other secure environment that includes security features that help to ensure visitation to a URL does not corrupt an underlying operating system and/or an underlying virtual machine. The tool 412 can optionally create a secure environment for purposes of allowing code or content changes associated with a suspect URL to occur, or to be examined, without posing a risk to the underlying host machine.
The final destination URL technology 416 may be implemented as a software module as a feature of a browser application or as an add-on feature for a browser application. While a top domain view was discussed with respect to
In many instances, a final destination URL is the most important third-party URL because it ultimately determines the final content displayed by a user's browser application. Noting, however, scenarios exist where a primary URL remains displayed in a browser application's address bar even when content is fetched from one or more other third-party servers.
The HTML frame view technology 440 can address scenarios where a HTML frame is used and as a result the final destination URL does not represent the main page shown to the user. A HTML frame view module 440 can record the URL being associated with a HTML frame and indicate instances where a HTML frame is used to fill the entire browser display area. In the case where a HTML frame is used to fill the entire browser display area, an exemplary browser URL analysis tool 412 can visit the URL associated with the HTML frame and then record any action in conjunction with display of the HTML frame.
The redirection URL technology 418 can group primary URLs, which do not generate any significant third-party domain traffic, by their intra-domain redirection-URL set. For example, both of these two typo domain names share the same set and, therefore, belong to the same group:
The redirection URL technology 418 can be implemented as a feature of a browser application or as an add-on to a browser application. An exemplary redirection URL module 418 can parse a redirection URL to identify an associated redirection-URL set and can then use the identified set to classify one or more other typo domain names, for example, as belonging to the same class and, likely, to the same cybersquatter.
While the examples given for the redirection URL technology 418 pertain to typo domain names, such technology can classify composite domain names (e.g., consider “microsoftoutlook.com” as an example of a composite domain name a cybersquatter may try to use).
The cybersquatting technology 400 includes an IP address analysis tool 430 that can perform IP address-based grouping. Such a tool may perform IP subnet-based grouping and/or a Whols registrant-based grouping. Groupings based on IP address or registrant information can be complementary to a top domain view and a final destination view. The IP address analysis tool 430 can provide views that group domain names by cybersquatter/owner.
The domain blocking technology 420 can be implemented as feature of a browser application or as an add-on to a browser application. The domain blocking technology 420 optionally operates in conjunction with one or more other technologies described with respect to
With respect to implementation of domain name blocking, an exemplary browser can maintain a black-list of domain names that it will not visit or an exemplary operating system can block connections to a black-listed domain name. As proxy servers in an environment can nullify the latter approach (browsers connect to a proxy, which then connects to the URL), an exemplary proxy server blocks black-listed domain names. Yet another approach communicates questionable domain names to a corresponding domain registrar for removal of these domain names from one or more servers.
The cyber-squat patrol technology 480 pertains to techniques applicable to non-typo domain name cybersquatters. For example, composite domain names are examples of domain names that have been used by cybersquatters. In general, analyses with respect to such domain names require more information than analyses with respect to typo domain names. An exemplary cyber-squat patrol technology 480 optionally operates in conjunction with a trademark database where trademarks associated with a particular owner are selected and combined in various manners and entered into a browser application. A database query such as a query for the Whols database or a TLD (Top-Level Domain) database may be used to find all domain names containing a certain substring associated with a trademark or trademarks. The cyber-squat patrol technology 480 can be implemented in conjunction with one or more other technologies discussed herein.
An exemplary method includes providing a list of registered domain names, providing a trademark, applying one or more algorithms that mimic typographical errors to the registered domain names or to the trademark to generate typographically erroneous domain names or typographically erroneous versions of the trademark, respectively, and identifying, from the first of registered domain names, one or more typographically erroneous registered domain names for the trademark. In turn, the method may include blocking web browser access to at least one of the one or more typographically erroneous registered domain names for the trademark. With respect to algorithms that mimic typographical errors, such algorithms may transpose two characters, replace a character with a neighboring character on a QWERTY keyboard, delete a character, etc.
The proxy log technology 490 uses information acquired from, or relating to, one or more proxy servers. A proxy server is a computer that offers a computer network service to allow clients to make indirect network connections to other network services. For example, a client can connect to a proxy server and then requests a connection, file, or other resource available on a different server. The proxy provides a resource either by connecting to a specified server or by serving the resource from a cache. In some instances, a proxy server may alter a client's request or a server's response for various purposes. The proxy log technology 490 can record proxy information. Such information can be optionally used in combination with one or more other technologies discussed herein.
The technologies 400 of
The method 500 commences in a provision block 504 that provides potential cybersquatting URLs. A trace block 508 traces the URLs, for example, using the URL tracer technology 240 of
Given some cybersquatting URLs and optionally ownership and/or domain parking service information, a reverse logic block 524 (see, e.g., the block 470 of
With respect to reverse logic, the block 524 may use an algorithm that determines whether a domain name can be transformed to a legitimate domain name (e.g., a trademark or other popular term) within a certain number of iterations. For example, given the domain name “microsfto.com”, such an algorithm can move each letter successively by one space (e.g., in a loop) where the number of iterations may be determined by the number of characters in the domain name (i.e., the portion prior to “.com”). Such an analysis may determine that a particular cybersquatter simply selects a character and moves that character to the end of a word. In turn, this information can be used to help identify domain names associated with the particular cybersquatter and to generate other typo domain names likely to be associated with the particular cybersquatter.
As indicated by the view module block 502, various URL related technologies 330, 414, 416, 418 and 440 may be used in conjunction with the method 500. Further, as indicated by the management features block 503, various management technologies 420, 450, 460 and 480 may be used in conjunction with the method 500. For example, the list block 520 can communicate URLs to an ownership database 450, which, in turn, can communicate information to a subscription service 460. The subscription service 460 can provide domain names to browser applications (e.g., via a network) such that a domain blocking feature of the browser application can block the domain names.
With respect to blocking domain names, an exemplary browser application or an exemplary subscription service can allow a user to choose one or more criteria for use in selecting domain names to block. For example, if a user is not interested in adult content, then the user may select an appropriate criterion that causes a subscription service or a browser application to load domain names associated with adult content to a domain blocking feature of the user's browser application. While adult content may be a popular criterion, a user may select from any of a variety of criteria including jewelry, magazine subscriptions, movie information, surveys, politics, etc.
As content served by a typo domain name (or composite domain name) may change over time or be adaptive with respect to history of users connecting (e.g., user address range), a subscription service may provide periodic updates for domain names.
While the example of
The secure virtual machine module 610 can create an instance of a virtual machine in a secure environment and display a secure GUI 630. In the example of
An exemplary method 660 includes a recordation block 662 that records information during a web browsing session. After recordation, a display block 664 displays a primary URL 622 and a final destination URL 624 (or other URL) associated with the primary URL 622. A creation block 666 creates an instance of a browser application in a secure environment and a visitation block 668 directly visits the final destination URL using the browser application. In such a method, the display block 664 can access a browsing history file where the browsing history file includes the primary URL and the final destination URL (or one or more other URLs). As already mentioned, a user may wish to block a URL or domain name. Thus, the method 660 may include blocking the primary URL based at least in part on content displayed by the browser application during the visiting the final destination URL. Alternatively, or in addition to, the method 660 may block the final destination URL based at least in part on content displayed by the browser application during the visiting the final destination URL.
An exemplary method may include determining if a primary URL corresponds to a typographically erroneous domain name and/or include determining if the primary URL corresponds to a composite domain name, for example, that includes a trademark. Where a composite domain name includes a trademark, a method may determine if the owner of the composite domain name owns the trademark. In turn, a method may block a composite domain name if the owner of the domain name and the owner of the trademark differ.
For every URL displayed in either of the views, the module 710 provides a right-click menu with two options: (i) a “Go” option that allows the URL to be revisited (so that the user can figure out which ad came from which URL) and (ii) a “Block” option that allows blocking of all future traffic to and from that domain.
The exemplary browser application 700 can be used in any of a variety of scenarios. An exemplary method for parental control 720 allows a parent to record URL information per a record block 722. When the parent notices inappropriate ads being displayed to a child, the parent can use the module 710 to scan recently visited URLs, per a scan block 724, as recorded in the record block 722. For example, the parent may select the “Go” or “Block” option from the “URL Scan History” view. In a determination block 726, the parent can determine which ads server was responsible for serving the inappropriate ads. The parent can then select to block one or more domain names, per the action block 728, to thereby protect the child's future browsing activities.
The user (e.g., trademark owner) can then use any of a variety of the view technologies (e.g., top domain names view) to identify those parking services that are heavily involved, per identification block 812. Once identified, the user can take appropriate action, per the action block 816. For example, such action may consider use of legal or other resources in a most efficient manner to address one or more entities involved in cybersquatting.
Such a domain parking-based analysis provides an efficient and low-cost solution for owners to file multi-domain complaints with major parking services, for example, to request banning of typo domain names from their parking programs.
Together with IP address-based grouping (e.g., block 430 of
An exemplary module (e.g., optionally a browser module or add-on) can include features to help identify those typo-squatters who are redirecting traffic back to the target websites through their traffic-affiliate programs as an alternative way to profit from typo-squatting. For example, the typo domain name “oveestock.com” redirects to the domain name “click.linksynergy.com”, which in turn redirects to the target site “overstock.com” (with a “siteID” field); similarly, the domain name “verizonwirewless.com” redirects to the domain name “service.bfast.com” and then to the target “verizonwireless.com” (with a “vendorid” field in the URL); “verizonwirelesa.com” redirects to “clickserve.cc-dt.com” and then to “verizonwireless.com”.
Various technologies described herein can be applied to non-typo questionable domain names as well, which may be obtained from the Whols database, reverse IP lookups, DNS zone files, services that monitor new domain registrations, etc. For example, by scanning a list of 3,990 cybersquatting domain names, all of which contain the full name of the target company as a substring in their domain names, an analysis determined that 2,938 of the domain names were active and that six domain parking services together parked 949 of these domain names (i.e., 32%). Again, the top two stood out as parking 509 (17%) of the domain names and as parking 321 (11%) of the domain names. Such evidence uncovered using various exemplary techniques reveals that the involvement of some domain parking services in the cybersquatting business may go far beyond simple typo-squatting.
As described herein, domain name blocking can be implemented as part of a browser application that can use browsing history as an online, on-demand resource for deciding which domain names to block. For example, Firefox browser application users can use the userContent.css file to block selected domains and INTERNET EXPLORER® browser application (Microsoft Corporation, Redmond, Wash.) users typically use WINDOWS® hosts files to block unwanted ads. Because the advertising business is an important part of Internet economy that supports free information, wholesale blocking would be problematic. Instead, exemplary technologies described herein allow a user to determine which ad came from which domain and allow a user to implement on-demand domain blocking to discourage advertising companies from serving questionable ads.
Third-party URLs have been used by malicious websites to execute and install malcode on client machines and by advertising and web analytics companies to implement web beacons (or web bugs) to track users' browsing behaviors. As described herein, various exemplary technologies can expose behind-the-scenes exploiters that pretend to be advertisement syndicators, but serve vulnerability-exploiting scripts instead of ads.
As described herein, various exemplary “view” technologies (e.g., top domain names view, etc.) can be used to expose web beacons. For example, consider a set of primary URLs grouped under a single third-party domain (e.g., about 10 or so) and the fact that an externally-visible IP address of the user's machine has remained static. Under such circumstances, a report to a third party may indicate that the IP address has visited the set of URLs, which may raise privacy concerns if appropriate privacy statements are not posted. Even in the instance where the IP address is not static, third-party cookies can be used to provide correlation. An exemplary module causes a browser application to highlight all websites that use cookies in a bright red color to alert users of a potential privacy concern.
Various technologies discussed herein help provide visibility into cybersquatting (including typo-squatting) business practices. Various technologies may be implemented in conjunction with or as part of a browser application. Such an exemplary equipped browser application can allow parents to protect their children by blocking domain names that are serving harmful material to minors. Various exemplary technologies can provide a light-weight typo-patrol feature, or more generally, a cyber-patrol feature that allows an owner of a popular website(s) to monitor potential trademark violations.
Various exemplary technologies can be used by domain parking services to help enforce their policies by uncovering systematic cyber-squatting domain names that participate in their parking programs and to identify large-scale cybersquatters among their customers.
The computing device 900 shown in
With reference to
The operating system 905 may include a component-based framework 920 that supports components (including properties and events), objects, inheritance, polymorphism, reflection, and provides an object-oriented component-based application programming interface (API), such as that of the .NET™ Framework manufactured by Microsoft Corporation, Redmond, Wash.
Computing device 900 may have additional features or functionality. For example, computing device 900 may also include additional data storage devices (removable and/or non-removable) such as, for example, magnetic disks, optical disks, or tape. Such additional storage is illustrated in
Computing device 900 may also contain communication connections 916 that allow the device to communicate with other computing devices 918, such as over a network. Communication connection(s) 916 is one example of communication media. Communication media may typically be embodied by computer readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media. The term computer readable media as used herein includes both storage media and communication media.
Various modules and techniques may be described herein in the general context of computer-executable instructions, such as program modules, executed by one or more computers or other devices. Generally, program modules include routines, programs, objects, components, data structures, etc. for performing particular tasks or implement particular abstract data types. These program modules and the like may be executed as native code or may be downloaded and executed, such as in a virtual machine or other just-in-time compilation execution environment. Typically, the functionality of the program modules may be combined or distributed as desired in various embodiments.
An implementation of these modules and techniques may be stored on or transmitted across some form of computer readable media. Computer readable media can be any available media that can be accessed by a computer. By way of example, and not limitation, computer readable media may comprise “computer storage media” and “communications media.”
One skilled in the relevant art may recognize, however, that the techniques described herein may be practiced without one or more of the specific details, or with other methods, resources, materials, etc. In other instances, well known structures, resources, or operations have not been shown or described in detail merely to avoid obscuring aspects of various exemplary techniques.
While various examples and applications have been illustrated and described, it is to be understood that the techniques are not limited to the precise configuration and resources described above. Various modifications, changes, and variations apparent to those skilled in the art may be made in the arrangement, operation, and details of the methods and systems disclosed herein without departing from their practical scope.
| Number | Name | Date | Kind |
|---|---|---|---|
| 5892919 | Nielsen | Apr 1999 | A |
| 6092100 | Berstis et al. | Jul 2000 | A |
| 6393465 | Leeds | May 2002 | B2 |
| 7376752 | Chudnovsky et al. | May 2008 | B1 |
| 7421498 | Packer | Sep 2008 | B2 |
| 7657507 | Shi et al. | Feb 2010 | B2 |
| 20020099693 | Kofsky | Jul 2002 | A1 |
| 20040010710 | Hsu et al. | Jan 2004 | A1 |
| 20040030741 | Wolton et al. | Feb 2004 | A1 |
| 20040220903 | Shah et al. | Nov 2004 | A1 |
| 20060004748 | Ramarathnam et al. | Jan 2006 | A1 |
| 20060036598 | Wu | Feb 2006 | A1 |
| 20060069667 | Manasse et al. | Mar 2006 | A1 |
| 20060069697 | Shraim et al. | Mar 2006 | A1 |
| 20060095416 | Barkhin et al. | May 2006 | A1 |
| 20060184500 | Najork et al. | Aug 2006 | A1 |
| 20060212925 | Shull et al. | Sep 2006 | A1 |
| 20060248072 | Brewer et al. | Nov 2006 | A1 |
| 20060253578 | Dixon et al. | Nov 2006 | A1 |
| 20060288078 | Mashimo | Dec 2006 | A1 |
| 20070179987 | Lim | Aug 2007 | A1 |
| 20090300770 | Rowney et al. | Dec 2009 | A1 |
| Number | Date | Country |
|---|---|---|
| WO2006036170 | Apr 2006 | WO |
| Number | Date | Country | |
|---|---|---|---|
| 20080250159 A1 | Oct 2008 | US |
