Case Studies

The following case studies highlight the extent of Unasi's typosquatting operations.

Case Study: "Trademark_X"

Trademark_X is the domain name of a company's global website, as well as being the most recognized trademark of the company. The company is in the top 10 regarding sales in its market, but it is not currently one of the top three most recognizable trademarks in the industry.

A typo generation tool available at DomainTools.com came up with a list of 174 possible typo domains of Trademark_X.com. These aren't actually all the possible typos of the domain - the tool takes into account that if a letter is typed in inccorrectly, that the incorrect letter is in the vicinity of the actual letter on the keyboard, or looks similar to the actual letter. Out of the list of these 174 typo domains, it was discovered that 74 of these typo domains were registered by parties other than the holder of the trademark. In addition, not a single domain registered by a 3rd party was being used in good faith - in every case the domain was being used either for type-in revenue-based advertising, or (in 2 cases) the domain was being redirected to another domain which was extremely different from the typo domain. The following table shows the breakdown of typo domain ownership:

Although Unasi is just one of the 21 holders of Trademark_X typo domains (representing 4.8% of the total number of typosquatters), Unasi owns 40.5% of all typo domains currently registered.

For the record: Later research revealed that Unasi actually at least 129 typos of Trademark_X. This discovery was made after looking through the actual lists of domain names registered to Unasi.

Aliases used for Trademark_X:

The 30 typo domains registered by Unasi are registered with 7 different aliases:

Caribean Online Internation Ltd
ClickConsulting LTD
Domain Drop S. A.
Keyword Marking, Inc
Maison Tropicale S.A.
Web Advertising Corp.
Marketing Total S.A.

The following number of typo domains registered with each registrar were: begiumdomains: 8 times, capitoldomains: 7 times, and domaindoorman: 15 times.

DNS Servers Used

The following table lists the domain servers used for the typo domains. Allthough almost every domain uses different DNS servers (with 4 exceptions) all DNS servers are (1) registered to the same company, (2) registered with either belgiumdomains, capitoldomains, or domaindoorman, and (3) were all registered on the exact same date.

View list of DNS servers

As was noted in a table previously in the report, Unasi's DNS servers are registered to DNS Services Ltd, with address: PO box 77, Nassau, BH. Amusingly, DNS Services Ltd's website is used for advertisements just as the rest of Unasi's domains. Notice that the link in the footer goes to a domain of one of Unasi's aliases, Wan Fu China:¹

Case Study From Microsoft^® Research

In 2005, Microsoft developed a tool called Strider URL Tracer with Typo Patrol, also known as Strider Typo Patrol. Using this tool, the developers gathered research about typo domains and typosquatters, and released periodic reports beginning in December 2005.

During this time, reports noted that the biggest typosquatter was a company which they identified as Unasi/Domaincar. In a report released in 2006², they referred to this person as "DomainSquatter". The following excerpt from the study reveals that at one point around 2005/6 (specific date not found), Unasi owned 1 of every 6 typo domains in existence:

...when a user made a typo and reached an active typo domain, one in every four such domains would serve ads from oingo.com and one in every six would profit DomainSquatter if the user clicks the ads. It is also significant to note that DomainSquatter accounted for 76% of the 2,107 typo domains parked with oingo.com.

The Google^™ Factor

oingo.com is the domain parking service of Applied Semantics (formerly known as Oingo). The company was acquired by Google in 2003 .

According to an article by the Washington Post published in April 2006³, Google refuses to disclose its earnings from ads on parked domains, though the article also states that Wall Street analysts estimated that almost half of its 2005 $6 billion revenue came from ads on partner sites. Although Google claims to remove any sites when there is a claim of trademark abuse, the company apparently makes no effort to proactively guard against trademark abuse. According to Rose Hagan, Google's chief trademark lawyer, "software formulas aren't smart enough to identify trademark infringements."

In spite of this claim, "Google adSense" technology seems quite proficient at matching typo domains with ads of the related trademarks. In the case of the Trademark_X, 76% of the typo domain websites were correctly identified as misspellings of the Trademark_X trademark, listing advertisements and links for Tradmark_X, competitors of Trademark_X, and generic terms for Trademark_X.

A month after the article the Washington Post article, Microsoft published another startling revelation: Unasi was using a single account with Oingo:⁴,

The real identity of Unasi/Domaincar may be discovered by following the money trail of Oingo.com's payment to its Client ID DTRG4295.

It would be sensible to suggest that if typo domains are spread out across thousands of accounts, then it is virtually impossible to deal with them. But if it's true that 70% of the typo domains using a certain parking service are from the same account, the situation changes drastically.

¹ Screenshot of www.dnsservicesltd.org, taken Sep. 2007
² "Strider Typo-Patrol: Discovery and Analysis of Systematic Typo-Squatting", Yi-Min Wang et al http://www.usenix.org/events/sruti06/tech/full_papers/wang/wang_html/index.html
³ "The Web's Million-Dollar Typos", The Washington Post, By Leslie Walker and Brian Krebs , April 30, 2006, http://www.washingtonpost.com/wp-dyn/content/article/2006/04/29/AR2006042900279_pf.html
⁴ "Strider URL Tracer with Typo-Patrol", research.microsoft.com: http://research.microsoft.com/URLTracer