Technology Advisor Blog

The more you know about the various types of cyber scams out there, the safer you'll be online. We recently received a question from someone in our community who's doing a lot of hiring and reported that someone had posted a job on a spoofed website - "domaincareers.com" instead of "domain.com".  Why do scammers do this?  They're trying to trick people into providing personal information like a social security number and possibly financial information so they can steal it.  It is true that before you start a job, you'll need to give your employer your social security number and you'll probably want to set up direct deposit of a paycheck, but if a company is asking for this information too early, its a scam.   Both employers and potential employees need to know about these scams.

Domain Name Abuse is the general category that encompasses various malicious activities involving the misuse of domain names to deceive, mislead, or exploit users.

Domain Spoofing: This is when scammers create a website with a name that looks similar to a legitimate business's domain name to deceive people. For example, they might use "domaincareers.com" instead of "domain.com" to trick people into thinking it's the same company.

Typosquatting: This is when scammers register domain names that are common misspellings or typos of a legitimate business' domain.  For example, they might use "doman.com" or "doamin.com" instead of "domain.com," hoping that people will accidentally type the wrong address and visit their fake site.  Do you have an "i" or a lower case "L" in your domain name?  These are very easy to swap to trick people.

The more you know!  In short, domain spoofing uses look-alike names to impersonate a business, while typosquatting relies on common typing mistakes.  It's like someone pretending to be you by wearing a similar outfit or disguise - digital impersonation.

Here's some simple advice for detecting and preventing domain name scams:

1. Set Up Alerts: Use domain monitoring services like Google Alerts to notify you if similar domains are registered. This way, you can quickly detect any suspicious activity.  There are also commercially available tools that can do more but this is a simple way to start.

2. Register Similar Domains: Proactively register similar domain names (like domaincareers.com, domainjobs.com) to prevent others from doing so. Also register any common misspellings of your domain.  This can be cost-effective insurance against scams.  It's inexpensive to register a domain as you'll just need the registration, no hosting or email.

3. Publicize Official Channels: Clearly list your official domain and communication channels on your website and all marketing materials. Encourage prospective employees to verify the source before engaging.

4. Educate Prospective Employees: Inform prospective employees and the public about the official domains and contact points. Educate them on the risks of phishing and how to recognize suspicious emails and websites.

5. Legal Action: If someone registers a similar domain and uses it to deceive people, you can take legal action. Report the domain to the hosting provider, domain registrar, and relevant authorities. You can also seek the help of a lawyer to take further legal steps.

By following these steps, you can detect and prevent domain name scams more effectively.

Google Alerts is a great tool to notify you of any activity surrounding your domain name (and anything else you're interested in for a personal news feed!).  If you haven't done this before, here are some simple steps:

Using Google Alerts to monitor for similar domain names is straightforward. Here are the steps to set it up:

1. Go to Google Alerts: Visit Google Alerts:  www.google.com/alerts

2. Create an Alert:

   • In the search box at the top, type in the variations of your domain name you want to monitor. For example:
     • "domaincareers.com"
     • "domain-jobs.com"
     • "domain employment"
   • Use quotes to get exact matches for the phrases.

3. Customize the Alert:

   • Click on "Show options" to customize how often you receive alerts, the sources (news, blogs, web), language, region, and how many results you want to get.
   • Choose "As-it-happens" for the most immediate alerts.

4. Enter Your Email: Make sure your email address is entered in the "Deliver to" field.

5. Create Alert: Click the "Create Alert" button to finalize.

6. Refine Alerts:

   • You might need to create multiple alerts for different variations and misspellings of your domain name.
   • Review and refine your alerts over time to ensure you're capturing the most relevant results.

By setting up these alerts, you'll be notified whenever Google indexes a new page containing the terms you're monitoring, which can help you stay aware of potential scams involving similar domain names.

Legal Action?  The FBI Internet Crime Complaint Center (IC3) is a place you can report if you're the victim of a cyber crime: www.ic3.gov

Here's a summary of some of the legal action you may want to consider.  There are several approaches you can try to take to stop bad actors from using similar-sounding domains:

1. Contact the Domain Registrar:

   • Identify the registrar of the offending domain using a WHOIS lookup tool (e.g., ICANN WHOIS).
   • Contact the registrar and report the issue, providing evidence of the potential scam or infringement.

2. Cease and Desist Letter:

   • Have a lawyer draft and send a cease and desist letter to the domain owner. This formal request can sometimes prompt the owner to take down the site voluntarily.

3. Report to The Hosting Provider:

   • Identify the hosting provider of the offending site and report the scam. Hosting providers often have policies against fraudulent activities and may take down the site.

4. Trademark Infringement Claim:

   • If you have a registered trademark for your domain name or business, you can file a trademark infringement claim. This can be done through a legal process or via the registrar’s dispute resolution policy.

5. Uniform Domain-Name Dispute-Resolution Policy (UDRP):

   • File a complaint under the UDRP with ICANN. If successful, this process can force the transfer or cancellation of the offending domain.

6. Report to Authorities:

   • Report the scam to relevant authorities, such as the Federal Trade Commission (FTC) in the U.S. or other consumer protection agencies in your country.

7. Phishing and Scam Reporting:

   • Report the domain to organizations that track phishing and scams, like the Anti-Phishing Working Group (APWG).

8. Public Awareness:

   • Publicize the scam on your official website and social media channels. Inform your audience about the fraudulent domain and advise them on how to avoid being deceived.

Taking these steps can help you address the issue legally and through various service providers, potentially stopping the bad actors from continuing their activities.

According to the World Economic Forum (WEF), cybercrime is the world's third-largest economy by GDP, after the United States and China.   In 2023, cybercrime was estimated to generate $8 trillion in revenue, and by 2025, it could reach $10.5 trillion.  The more you know about the various types of scams out there, the safer you'll be online, but note that the cyber criminals will be working hard to develop new techniques, so stay alert!

Ekaru works with local businesses to strengthen cybersecurity with our approach "Cybersecurity For Main Street".  Reach out to us if you'd like to set up a short call and learn more!