Domain Name Monitoring

Overview

Cloud Temple’s Nameshield Essential Monitoring automatically detects, on a weekly basis, newly identified domain names that bear a strong orthographic similarity to your trade mark — with no limit on the number of results. Unlike monitoring with analysis, the raw results are delivered to you in a weekly report, whilst the analysis is left to your teams.

How it works

Based on a brand name or term that you provide, our system identifies all misleading and fraudulent domain names using that term and its variations, and then sends you a weekly email listing them.

Comprehensive data sources

• Zone files for generic registries and country-code registries that share their zone file
• Real-time Certificate Transparency Logs
• Active DNS data across all gTLDs, ngTLDs and ccTLDs

A ready-to-use weekly report

Each week, the domain names detected are sent to you by email in Excel and PDF formats, complete with the information required for their analysis (dates, registrar, presence of a website, mail and DNS servers, WHOIS). The analysis and decision on remedial action remain the responsibility of your teams; an API is available as an option for retrieving the results.

How to use

1. Sign up for the offer via the Cloud Temple marketplace.
2. Please provide Nameshield with the trade marks and names to be monitored.
3. Nameshield configures your monitoring scope.
4. Receive your detection report by email every week (in Excel and PDF formats).
5. Analysise the results and, in the event of a confirmed threat, initiate a remediation procedure.

Support

As part of a programme to surveillance without analysis, our tools automatically detect the newly observed domain names featuring a high orthographic similarity with the trademark in question. In other words, weekly, these domain names are sent by email in a report containing all the information required for your teams to analyse them.

Our solution is based on Enter a brand name or name of your own. Based on this trademark or trade name, all misleading and fraudulent domain names that exploit this term are identified, with no limit on the number of results.

Sources of data collected

We monitor the registration of domain names:

• As and when they are published, in the zone files provided by generic registries and country-code registries that share their files;
• In real time, in the certificate generation logs (Certificate Transparency Logs).

Furthermore, we analyse live DNS data to round off our exploration of country code top-level domains (ccTLDs). We therefore monitor domain name registrations on the generic extensions (gTLD), the new extensions (ngTLD) as well as all country codes (ccTLD), i.e. all top-level and second-level domains.

This data is collected continuously and form the basis on which domain names that bear a resemblance to the monitored trade mark are identified. This identification is carried out once a week.

Detection of misleading domain names

Our methodology for detecting potentially fraudulent domain names similar to the monitored trademark is based on a search for the exact trademark name and its variations. These terms are searched for in our database of collected domain names, using queries devised by our team of analysts specialising in the monitoring and analysis of new domain name registrations.

The engine underpinning this detection offers a suite of tools that can be combined to implement variations in a brand’s monitoring strategies, including:

• Typographical amendment : adding and deleting characters, substituting and permuting characters;
• Orthophonic modification : checking for phonetic equivalents and approximations, checking for spelling mistakes, checking for typing errors;
• Truncations : searches for truncations of any length to the left and right of the search term.

The service takes into account the fact that certain special or non-ASCII characters look very similar to letters of the alphabet and may be used in domain names to cause confusion. We maintain a conversion table and systematically replace these characters with the letters of the alphabet that they resemble.

Reporting

The domain names detected are listed in a report sent by email on a weekly, in the following formats Excel and PDF. The reports contain the raw results detected by our tools, which are transmitted automatically and supplemented with the following information:

• Domain name; ;
• Domain creation and expiry dates; ;
• Domain registrar; ;
• Existence of a website (URL, description);
• Mail servers;
• DNS servers;
• WHOIS information.

Optionally, the domain names detected and listed in the weekly report can be retrieved from a API.

Your teams carry out the analysis of the results, in order to identify domain names posing an immediate risk, in respect of which remedial action must be taken, as well as domain names that need to be monitored to detect any changes in the threat.

Reports remain available on the platform for the duration of the contract. They are deleted upon termination of the subscription, three months after the end of the service, following a reversibility period.

Terms and conditions

Use of the Nameshield service is subject to the terms and conditions of service available at www.nameshield.net. Data is hosted in France and processed in accordance with the GDPR. Any subscription implies acceptance of the current terms and conditions of service.