Comment by tempestn | Hacker News Reader

Comment by tempestn | Hacker News Reader

Parent Full thread

For what it's worth, the problem with that process is that it creates an uneven burden. Any scammer with 10 bucks can create a misleading domain. This happened to us when some scammers created "autostempest.com" to mimic our car search site, autotempest.com. They put fake listings up and scammed many people out of tens of thousands of dollars. Our only legal recourse was a UDRP claim (short of suing namecheap, which would have been even more expensive), but that would have cost about $2000 because you need to go through a registered provider—and these are private companies, which take advantage of this regulatory oligopoly.

Now, $2000 would be worth it to shut down a scammer like that, except nothing stops them from simply ignoring the UDRP claim and once their domain is shut down, they can register autotempests.com or something for another 10 bucks. (They actually did end up registering autostempestgroup.com and several others.)

On the other hand, if you could simply go to the registrar, show clear evidence of the very obvious infringement, and have them shut down the domain, perhaps it would actually be feasible to put a dent in that kind of scam.

I do understand the concern of having a private company like Namecheap be the judge in these matters, but I'm not sure it's as black and white as that. I could see a system working where they do take unilateral action on obvious cases (autostempest, whatsappdownload.com, faceb00k, etc.), but require the formal process for less clear cases.

I understand this complaint. But Facebook attacking Namecheap in a public post for doing the right thing is the wrong way to go about changing the system. They should instead petition ICANN and/or their political rulers to change the process.

So here's the trouble with "it's obvious":

http://www.slutsofinstagram.com/

"Slütsof In Stagram", naturally, what did you expect? See also "Whöresof In Stagrâm" at similar URL.

Yes, someone tried to register SlutsOfInstagram.com and WhoresOfInstagram.com and when Facebook/Instagram objected, they turned the sites into something else entirely.

The point being that you can't really tell anything from the name.

But then you can't really tell anything from the content either, because if there is phishing content the first thing the registrant will claim is that they've been hacked. Which is hardly uncommon in that context. So then you need someone to make a judgement call. Which is what courts are for.

If there's a combination, it's very obvious. To use my personal example again, the domain was autostempest.com, and they had copied our logo directly, and created a car listings site. It would be trivial to see that we were using the name and logo first.

Going to court just wasn't an option. For one thing, we couldn't even identify the people behind these sites without first going to court against namecheap. And after all that effort and expense, it's entirely possible they'd registered the domain with fake info and the effort would have been wasted. Even the UDRP option was not cost effective, because nothing would stop the scammers from opening a new fake domain. What we eventually did that worked was found a "CSIRT" company that would use its private connections to hosting providers to, for a fee, get offending content taken down. So, that's the kind of thing the status quo is incentivizing. Hardly better than if there was a takedown process available through namecheap it seems.

That said, you'd certainly want to avoid the situation with Youtube, where the power is swung all the way in the other direction, so creators have almost no recourse when purported rights holders issue a claim.

I used to work for a company that offered brand-protection services. The customer would grant my old employer power of attorney to send C&D letters and file takedown lawsuits on their behalf, and we would do all the monitoring and brand-defense work, then send a report to the customer justifying the exorbitant fees.

Maintaining a trademark costs time and money. You can save money by doing the work yourself, or by using backchannels, as you mentioned. You can save time by hiring someone to do the tedious work for you. Even a single-partner specialist law firm should have boilerplate templates on hand for taking down an infringing website fast, using regular channels. I imagine that most of the cases result in no answer from the main defendant and default judgment that orders the registrar to transfer the domain to the plaintiff, who can then blackhole it or redirect to the genuine site.

A higher-service firm will also proactively scour the Internet for threats to your brand--at a higher price, of course.

I would not recommend my former employer for this, as they got bought out, and the new owner arbitrarily fired the entire development team.

> To use my personal example again, the domain was autostempest.com

So then they claim their company is called Auto Stem Pest in the business of selling automatic pest control devices, and their website had your logo on it "temporarily" because it had been compromised by third party malicious hackers.

Somebody has to decide whether that story is a load of BS. But it's a thing that could realistically have happened, and Namecheap has neither the resources nor the qualifications to stand in judgement.

> Going to court just wasn't an option. For one thing, we couldn't even identify the people behind these sites without first going to court against namecheap. And after all that effort and expense, it's entirely possible they'd registered the domain with fake info and the effort would have been wasted.

The thing is, that's what happens anyway. Most of the people doing this are in countries that just don't care. Having their names generally won't do you any good.

> Even the UDRP option was not cost effective, because nothing would stop the scammers from opening a new fake domain.

Which points to domains being a bad point of attack to go after them. It's like trying to catch cat burglars by maligning department stores that sell gloves. It's just not a useful place to apply pressure.

For fraudsters in a friendly jurisdiction, courts work, because the process is a pain in the butt but at the end of it they go to jail which is a large enough deterrent that it mostly stops them to begin with.

When they're in an antagonistic jurisdiction (which is most common), the law can't help you, because it isn't your law that applies. At that point you're down to technical and market solutions, like the one you found.

Reply on news.ycombinator.com