Cybersquatters Exploit Web-Name Trial-Period Loophole

Sunday , February 18, 2007

NEW YORK —

It's not often you can compare Internet addresses with clothing, but a growing practice comes close, contributing to a global shortage in good names.

Entrepreneurs have been taking advantage of a five-day grace period to sample millions of domain names, keeping the relative few that might generate advertising revenues and dropping the rest before paying. It's akin to buying new clothes on a charge card only to return them for a full refund after wearing them to a big party.

The grace period was originally designed to rectify legitimate mistakes, such as registrants mistyping the domain name they are about to buy. But with computer automation and a burgeoning online advertising market, entrepreneurs have turned the return policy into a loophole for generating big bucks.

Experts believe spammers and scam artists are also starting to use the grace period as a source of free, disposable Web addresses.

With up to 6 million names tied up at any given time through a practice known as domain name tasting, individuals and businesses are having even greater difficulty finding good names, particularly in the already-crowded ".com" space.

"The system really doesn't work to the advantage of people who have legitimate reasons for wanting names," Frederick Felman, chief marketing officer with MarkMonitor, a brand-protection firm. "It allows people with criminal or speculative intent to dominate."

Cybersquatting has been around for more than a decade, and scores of entrepreneurs have made thousands and even millions of dollars reselling names they had bought for as little as $6 each. With tasting, entrepreneurs generally aren't grabbing names to resell but to generate traffic and share in online advertising revenues.

The Internet's key oversight agency for domain names, the Internet Corporation for Assigned Names and Numbers, or ICANN, has for years required operators of major Web suffixes such as ".com" to refund cancellations within five days. Tasting became more practical about two years ago when automation allowed newly available ".com" names to go live almost immediately, providing an additional half-day for sampling.

The practice has spiked, with an average tasting of 1.2 million names each day in December, compared with 7,200 two years earlier, according to data from Name Intelligence Inc., which analyzes domain name patterns. Legitimate registrations made up 2 percent of the registrations at the end of 2006, down from about half in 2004.

In an e-mail statement, one company that engages in tasting, Wang Lee Domains, said the practice was "perfectly legal" and brings "customers to the companies that advertise."

Moniker Online Services LLC, which lets customers try out domains for a small service charge it keeps, said companies can identify the right names to buy and not overspend for ones that don't matter. Monte Cahn, Moniker's founder and chief executive, said many leading brands do it, although he would not name them.

"Tasting is similar to test driving a car before you buy it or doing a walkthrough of a house before you buy," Cahn said.

The loophole works this way:

Speculators write software to automatically register hundreds or thousands of names. Some are variants of trademarks or generic keywords that Internet users are likely to type — or mistype. Others are names grabbed after their original owners fail to renew.

During the grace period, the entrepreneur puts up a Web page featuring keyword search ads and receives a commission on each ad clicked. Services like Google Inc.'s AdSense for Domains and Yahoo Inc.'s Domain Match help large domain name owners set them up, even as the search companies officially oppose abuses in tasting.

Addresses likely to generate more than the $6 annual cost of domain name are kept — not a high threshold given how lucrative search advertising is these days.

The rest are thrown back into the pool on the fourth or fifth day, only to be grabbed by another group of domain name tasters.

"Everyone's trash is someone else's gold," said Jay Westerdal, president of Name Intelligence. "You'll see this with three or four companies that keep going through the trash of everybody else."

And because the process is automated — the names are grabbed as soon as they are let go — legitimate registrants barely have a chance, Westerdal said.

The department store chain Neiman Marcus Group Inc. even filed a federal lawsuit last year accusing the registration company Dotster Inc. of tasting hundreds of names meant to lure Internet users who mistype Web addresses. At one point, the lawsuit said, the misspelled NeimuMarcus.com featured ads for Target, Nordstrom and other rivals.

David Steele, an attorney representing the retailer, said Neiman Marcus could have placed ads on those sites as well, but "should Neiman Marcus have to pay ... for directing people back to their Web site?"

The two parties recently agreed to settle, though Steele said details won't be announced until at least this week (Dotster declined comment). He said his law firm, Christie, Parker & Hale LLP, also was preparing litigation against other tasters.

Operators of the ".org" database have tried to strike back, winning approval in November to charge a restocking fee.

But VeriSign Inc., which runs ".com" and ".net," has not publicly backed one. The oversight agency ICANN said it was still studying the extent of the problem.

Critics of the system say VeriSign and ICANN both benefit from the thousands of names that are tasted and kept, collecting fees proportional to the number of names sold.

VeriSign said decisions should follow community-wide discussions.

"The risk is you don't want to necessarily move too fast or have a knee-jerk reaction without understanding the ramification," said Michael Denning, general manager with VeriSign's Digital Brand Management Services, which encourages companies to register additional domain names before tasters can get to them.

The practice, meanwhile, shows no signs of waning.

A newer variant, sometimes called "kiting," involves the same company reregistering the same name every fourth or fifth day to hang onto it in perpetuity, without ever paying for it.

Anti-spam experts also suggest that spammers and scam artists are turning to the loophole to register new names every couple of days to avoid detection.

"We see them using hundreds and hundreds of domains, and even at $5 a domain, that's costing them thousands of dollars, which they probably don't want to be losing," said Matt Sergeant, senior anti-spam technologist at MessageLabs Ltd.

Steele, the Neiman Marcus lawyer, said many of the dispute-resolution rules written for the pre-tasting days are no longer effective.

"By the time you expend the time and effort to track and figure out who's going after what names, they have moved on," he said. "A day where 100 Neiman Marcus names get registered is not an uncommon day."