.AI Domains and the Impact on Your Overall Domain Strategy and Cybersecurity Posture

WEBINAR TRANSCRIPT

Disclaimer: Please be advised that this recorded webinar has been edited from its original format, which may have included a product demo. To set up a live demo or to request more information, please complete the form to the right. Or if you are currently not on CSC Global, there is a link to the website in the description of this video. Thank you.

Christy: Welcome to today's webinar, ".AI Domains and the Impact on Your Overall Domain Strategy and Cybersecurity Posture." My name is Christy DeMaio Ziegler, and I will be your moderator.

Joining us today is Justin Hartland. Justin is CSC's Global Director of Domain Products for the Digital Brand Services Division. Justin has spent more than 20 years in the domain name and brand protection industry and brings his wealth of knowledge to CSC clients. Justin also focuses on ensuring that CSC provides market leading products and solutions to our global client base. And with that, let's welcome Justin.

Justin: Thank you so much and thank you for everybody joining today. And I am just going to take us on to our agenda for today's session. So firstly, we're going to start off with just a general look at artificial intelligence and what's happening in that area. We're then going to spend a bit of time understanding what .AI is, the registration trends, the infringement trends, rules and regulations, and what's going on in that space. We'll have a look at some other domain extensions that have also been reused and repurposed, such as .AI has been. And then finally we'll go through how does this fit into your global domain name strategy. So we'll look at the various aspects that you need to take into account not just for .AI but for all domains, but we'll focus it on .AI today.

Okay. So moving on, so we'll firstly have a look at some AI trends. So here are some statistics that I found when I looked through some reports by Accenture and Forbes. And a couple of things that I really wanted to highlight, obviously you can read through these, but really the first one is just the financial impact of the AI market. So here you've got the UK AI market is currently worth just under £17 billion. It's expected by 2035 to be worth over £800 billion, and this is just the UK. So obviously, if you think about the U.S., if you think about Europe, if you think about Asia-Pacific, this market is going to be absolutely huge in the future.

And then I also just really wanted to highlight the final point, which is 83% of companies are considering using AI in their strategy to be a high priority. So for those of you on this call, chances are either your company is already using it or it's very high on the agenda for your company. And what's really interesting and you see this in a lot of the news coverage and how AI is being used, it's not just a tech thing. It's being adapted and used in so many different areas. So a very interesting area, definitely a very big growth area, and that's one of the key reasons we really wanted to talk about .Ai and how you can use it and what you should be aware of in this space because of what's happening out in the marketplace.

Okay. So the next part is a review of the actual .AI extension. And it gives me great pleasure to put maps in presentations. I am a bit of a geography freak, so I love showing maps. And .AI is not a gTLD. AI is actually the country code top level domain for Anguilla, which is a very small island in the Caribbean. It has a population of just over 15,000. It's only 35 square miles. The general business for Anguilla is tourism and offshore banking. But obviously they were very lucky to get the extension .ai. And for those who may be newer to the domain industry, every single country in the world is allocated a two-letter domain extension. So for the UK it's .uk, for France .fr, for Canada .ca. And Anguilla got issued with .ai. Now I read up on this, but Christopher Columbus actually named Anguilla. So maybe Christopher Columbus is the reason why Anguilla is very lucky to have the .ai domain extension.

So that's the sort of background to this extension, and what we're seeing now is an explosion, not from people in Anguilla, but from people outside Anguilla really utilizing this domain. So I'll go into more details on this.

So as I mentioned, AI seems to be in the news every single day. A new piece of technology, a new company using it. There's governments getting involved understanding how it should be governed in the future. It's really top of the agenda right now from news outlets. And what that's also meaning is that it's raised up the agenda for all large organizations and how they can use and adapt AI into their current processes. And obviously, because of all of this news and information, .AI does pose some threat to businesses.

And then, finally, we've got marketing teams using AI. They're going to be using this as they promote products and services in the future because it's the new "buzz." It sort of reminds me a little bit of when cloud computing came about a few years ago and it was the complete "buzz." Everybody was talking about it. It was the term that everybody used. It's just become a bit of the norm now, but I think that we're going through a very similar situation with artificial intelligence.

Okay. So if we have a look a little bit further at what does that mean with regards to the .AI domain extension, so this extension offers two key things. One is it gives you an opportunity to promote your services, which are associated with artificial intelligence, and two is you need to look at this on whether you're going to have it as part of your defensive strategy.

Now I've got two pieces of information here. So the first is a piece that we did here at CSC, where we analyzed the top 100 global technology companies to see if their core domain string was registered under the .AI extension. And as you can see, 34% were registered to those customers, 63% were owned by third parties, and 3% were still available. So obviously some early adopters and some very large companies have already taken their .AI, but that has not proliferated around all technology companies. And we used technology companies because we figured that they would be early adopters to this domain extension. So this is sort of showing us that third parties are already there and already taking domains that are that are branded names.

And then the other statistic we have on here is UDRP filings. Now for those who don't know what a UDRP filing is, most domain extensions have a dispute policy. So if you feel somebody has got a domain name and they're using it in bad faith, you can go through this dispute policy to reclaim the domain. And there is a process, a UDRP, uniform dispute resolution policy, and you can use that to file against your brand being misused. Now, as you can see, over the previous four years there were very few filed against .AI. This year it has rocketed up. So on this chart, it's gone up by 400%. I actually just checked, and so in the last week it's actually gone up even more. So it's about 500% now. So this chart is constantly changing, and that's just showing that companies are paying attention to this space now, but also realizing that there is a lot of third-party registrations, which is demonstrated in piece of research that CSC have done. So from a threat point of view, you have to realize that there is already third parties taking names in this space.

Okay. If we move on and look at the popularity, so I'll just take a moment, this chart shows the number of registrations under the .AI extension. And if you can see it, there is a line drawn in December last year, and that line drawn is when ChatGPT was released. And as you can see, subsequent to that, the number of registrations in .AI have increased significantly. And whilst this chart only goes up to June, we do know that those levels of registrations have continued to grow. So what this demonstrates, again we just saw third-party registration, we're seeing the popularity, we're seeing it registered more. So these are all factors that you must take into account.

And when looking at a domain registration and there are a lot of different domains that you can register. And there are different traits that create reasons why other people will register those names, and one of the biggest ones is when you have rules and restrictions. So some domain extensions require you to submit a trademark when you want the name which is directly associated with your brand. For those domains, it's almost impossible for anybody else to register. But where there are no restrictions and anybody can register, so probably the domain that gets the most fraudulent registrations is .com, and.com generally it has no restrictions and anybody can register. So with AI, this is also the same case. So like gTLDs where there's no restrictions, you do not have any here.

What this also means is that registrars who sell to the masses, we refer to them as retail registrars, they are also offering .AI registrations because it can be automated and people can register it and not have to provide documentation or anything like that. So it's nice and simple, so retail registrars are offering it. And when that happens, then we also generally see cybersquatting increase on those extensions.

Now there is an auction associated with this domain extension. I'm going to go through that in just a moment. And when I say just a moment, I mean just now. So .AI is running an auction site, which happens every two weeks and runs for two weeks. Now this auction site is made up of lapsed domain names, so the vast majority on there they're just generic terms. So if your company was looking for a good domain name with .AI, then there could be terms on there that would be of interest to you.

However, there can occasionally be domains on there which are branded names. And so, for example here at CSC, we are looking at this auction site, and we're seeing if any of our customers' branded names are on the auction and helping customers to identify those and take the appropriate action. There is a way that if you have a trademark for that name, we can contact the registry and they will get the name for us. But if there's other names that you wish to get off this auction site, then CSC can also assist with that.

One of the things that we've seen, at CSC we run a Brokerage Team who help acquire domain names or sell domain names for our customers, and that team has seen a huge increase in activity on .AI domains over the last year, in fact more than they've ever seen since .AI has been around. And so they have been working with our customers getting names back and trying to get generic names associated with it. So that's again just showing that the popularity of this extension is increasingly increasing.

Now the example here is nothing and there is a "k" missing off it, but a domain called expert.ai was sold last year for a $108,000. I recently read that mpc.ai sold for $250,000 in the last couple of weeks. So companies are looking at this as a valuable domain extension. And so we're going to hopefully see companies utilize this, not just register it for defensive purposes.

Again, the one thing I would say, from the research I've done, a lot of startups in Silicon Valley and across the world are starting to use .AI as a domain extension for their business. Previously, the extension .io was what a lot of startups were using, and we'll kind of talk on that in a few moments.

Okay. So to summarize, there is an opportunity here, which is to use the .AI domain extension to promote the artificial intelligence work that your business is doing. We've got an example here. If you type in microsoft.ai, it redirects to Microsoft's artificial intelligence page.

The other piece that's really important, and I do want to stress this, is Google recently announced that they will treat the .AI domain extension as a generic top level domain. So as you know, they have lots of algorithms and that looks at how the domain is structured as well as content of the page. But instead of treating it like a ccTLD for Anguilla, it is now being treated like a generic, like a .com. So that makes it extremely useful for companies who want to put business sites up on it. So there is a great opportunity with this domain extension.

And then there's the threats, and we just touched on it. Third parties are doing a land grab, and we're seeing branded domains being taken by third parties. And the other piece is with no restrictions and with retail registrars registering .AI, we are seeing increased third-party registrations for brands. There is also just generic names being taken up in the space as well. So there's an opportunity here, but there is clearly a threat already.

So next I just want to cover repurposed country code domain names, and the reason we're looking at this is to see if we can learn anything about previous domain names that are going to be applicable for .AI. As I mentioned, .AI has been around for a number of years, but it's because of what's happened within the market that it's now exploding and becoming a really important domain extension.

So this isn't all domains that have been repurposed, and what I mean by "repurposed" is they are a country code domain name, but they've been marketed or used in a way that isn't for that country. So I'll go through some examples.

So at the top, you've got .co, which was kind of promoted almost like an alternative of .com. And .co is the country code for Colombia. You've then got things like .ws for Samoa, and that was promoted as website. And then you've got sort of a few more niche ones, like .nu, which is for the Pacific island of Niue. And the term "nu" means now in the Nordics and some Northern European countries, and so it became very popular in those countries. And if you do go and visit those countries, you actually see companies using that as their web address.

The one I wanted to point out here is .io, which was really adapted and used by a lot of technology companies, and IO sort of being input/output. And British Indian Ocean Territory has actually nobody living there, apart from I think an army base, and there are almost 1.2 million registrations for this domain.

So if I look at Anguilla and .AI, currently there's 197,000 domains, and there is 1.2 million for .io. And I think that, over the next year or so, we are likely to see AI move up this chart and become as popular as something like .io because people are going to use it, startups are going to use it, companies are going to start utilizing it. It can be used for marketing campaigns, etc.

So you've got a lot of these ccTLDs which have been reused and repurposed, and .AI is one of them. And just something worth bearing in mind, we're obviously talking about .AI, but when you are looking at your domain portfolio and even if you're a business that only really works in a couple of countries, it's worth considering whether any of these are relevant to your business. So obvious example is if you're a media company but you only work in a particular country, .tv may be of interest or .fm. So there are things like that, and these are ccTLDs. They're not gTLDs. They're not new gTLDs. And so you need to think about those and making sure that you protect yourselves in those areas or utilize these domains if you think they're relevant for a particular marketing campaign.

Okay. So how does all of this fit in with your global domain name strategy? So when I look at the basics of what makes up how to create your domain portfolio, you've got to look at a number of areas. So one is what are we going to register to mitigate risk and also utilize within our business. And so, as I mentioned in the previous slide, there are certain TLDs that I may want to protect myself against because I just don't want anybody else going for them. And there may be some where I'm like actually we're going to use those.

Then you've got blocking. So there are a number of blocking products in the market, which basically means you're not registering a domain, but you're preventing anybody else from getting that name. Now .AI is not a part of any blocking product, so that is not an option for this particular TLD.

And when we look at secure, so secure is so I've registered these names, potentially blocked these names. The names I've registered, have I got the right security protocols on them? Now for some domains, they offer things like registry lock or DNSSEC. These are the things that you need to be thinking about putting on your domain portfolio. Now .AI does not have registry lock or DNSSEC. We are talking to the registry about potentially having these in the future, but at the moment they're not there. But just talking broadly about your domain portfolio, these are the things that you should be thinking about.

Now do you go and defensively register everything? Well, you might want to just defensively register the core terms, maybe some secondary terms, maybe some product names because they might have some association with AI. But anything else, you may just go, "You know what, if somebody is going to my brand plus a term and my brand plus a term and it just goes on forever, I can't register all of these. I don't have an unlimited budget." So that's where a really good monitoring solution comes in and just sort of puts a nice loop on this where I know I've protected here, I've blocked here, I've locked the names down, and I'm monitoring the internet to make sure nobody else takes names and I act if they do.

And I mentioned this earlier, but the key drivers in registrations and the key reason why we see cybersquatting and also domains used by third parties, used by bad actors, one is price. And if a domain is super expensive and there are certain ccTLDs out there that are really expensive, and then there are certain domains which are relatively cheap, and so whilst AI is not .com cheap, it is not super expensive. And the other thing to be aware of, if you are registering a .AI, is that the registry only allows a two-year registration. So you can't just get one year. You have to buy it for two years. So the price does come up a little bit higher because it's over a 24-month period.

Demography, so for example, here in the UK there's 64 million people. That's a big market. If I've got a .UK, I can sort of enter that market, etc. Now whilst Anguilla is not very big, .AI, as Google have shown by changing their rules, is going to be more in a generic standpoint in the world, so that opens it up to more than just the UK, to the whole world. So that's something important to take into account. And I touched on this earlier, rules. There are no rules to register a .AI as with .com and other extensions.

And then security profile, again I'm just about to go into this, but you need to look at does a domain extension have a known track record in phishing and fraud, etc. So that's something else to bear in mind.

And this is some data that was put together last year by CSC, looking at various domains and whether they are used a lot in phishing attacks. And as you can see, .io does show up on this, and we have seen phishing and spam and other things happen on this extension. So whilst AI is not showing up yet, I'm highlighting the fact that IO, which I think is one of the most similar TLDs to this one, it has seen some fraudulent behavior against it. So at CSC, we are going to be looking into AI and whether it's going to follow suit as something like .io, and we'll publish more information as we get it.

And then this is just a reminder there's various brand threats. I just talked about the phishing on IO. Any one of these can be used. If people take your .AI, it could just be a misuse. It could be traffic diversion. There are so many different things people could use for this domain extension. But that's just something we need to bear in mind when we're choosing what to register, what to protect, or whether we're going to be utilizing this.

And the final slide here, so here's what I recommend. Firstly, sit down with your internal teams, especially marketing, and discuss if you want to get a .AI domain name. To really sort of pull that list together, I would look at your core brand names and understand where you've got gaps in your portfolio. I would also look at have I already been infringed and enforce your rights against those names. And then based off having those discussions with internal teams, then there may be names that you think you might use in the future, but just get those registered and protected and off the market. As I said, there's no blocking product with this. And then for any other terms that you feel like, okay, well, we're going to register these 20 names, but we're not going to register the full list, then just make sure you've got a really strong monitoring solution in place.