A Conversation with Meta's Domains Off-Platform Enforcement Team
In this exclusive interview, Tony Kirsch from the Brand Safety Alliance sits down with Daniel Madden, a senior member of Meta's brand protection team, to discuss the unique challenges of protecting one of the world's most recognized brands, the decision to implement GlobalBlock, and the future of online brand security.
The Meta Approach: Protecting Users First
Tony Kirsch (TK): Thanks for spending some time with us Daniel. Tell us about your role at Meta and how brand protection fits into your responsibilities.
Daniel Madden: I'm part of Meta's Domains Off-Platform Enforcement team. We handle online brand protection across domains, app stores, paid search, social media, and marketplaces. We also oversee domain name registrations, covering both brand protection and domain operations.
We wanted to improve our security posture by owning and operating our own registrar: eliminating concerns about third-party vulnerabilities, especially with the strategic importance of some domain names we manage. There are also significant economies of scale when you evaluate accreditation based on existing domain volume.
TK: From the outside, it looks like your policy is to protect everything, everywhere. Is that accurate?
Daniel: That has been our approach historically, somewhat of a scorched earth policy. We've registered domain names to protect our trademarks and brands wherever possible across both gTLD and ccTLD namespaces. That strategy served us well for many years, but it obviously has challenges: an ever-expanding domain name portfolio, inconsistencies with TLD policies, the upcoming gTLD expansion, and the overall cost and operational overhead.
TK: Let's talk about brand protection more broadly. What does it mean for an organization of Meta's size and reach?
Daniel: Before I joined Meta, I worked at a law firm as a paralegal focused on intellectual property: protecting trademarks, fighting copyright infringement. When I joined Meta, I realized it's not just an intellectual property exercise or asserting legal rights. It's actually a critical user safety function and corporate risk factor.
If a bad actor registers a domain like 'facebook-login.com,' the consequences go way beyond trademark issues. A lookalike domain is usually the first step in a phishing chain that ends in a compromised account, and once an account is compromised it can be used to target that person's contacts, run scams, or spread further phishing. So the cost isn't only reputational or financial, it goes far beyond that.
TK: Why is user protection so important in this context?
Daniel: We're constantly working to get ahead of novel ways to compromise user accounts, including via phishing attempts. Account compromise is a persistent, industry-wide problem, not just a Meta problem and phishing remains one of the most common attack vectors, regardless of the platform you're on.
A real, long established account is far more valuable to an attacker than one recently created - those accounts have history, contacts, and trust. That's why we invest on both sides of the chain, reducing the infrastructure that enables phishing in the first place, and detecting and recovering compromised accounts quickly when it happens.
Why GlobalBlock Made Sense
TK: Your strategy is to protect everywhere you can. What prompted you to explore GlobalBlock?
Daniel: As the world has become more complex, we've found ourselves looking for solutions that offer deeper protection and in particular, those that can help us be more proactive.
The traditional model of domain enforcement is reactive. A bad actor registers a domain, puts up abusive content, be it phishing, malware, whatever. When detected, that's when brand owners may start takedown actions through frontline enforcement and DNS abuse notifications, and escalate to UDRP if needed.
However, all of that happens after the damage is done. GlobalBlock has helped us to flip that model: it's a scalable, cost-effective solution that blocks those key terms before registration across hundreds of TLDs.
TK: What was the internal evaluation process like?
Daniel: I'll be honest, I was initially skeptical. I'd seen similar offerings in the past relating to domain blocking and wasn't particularly impressed. After sitting down with the Brand Safety Alliance team, it was a really good conversation and helped to unpack many of the key benefits that weren't initially obvious to us, as well as a clearer understanding of the Brand Safety Alliance's commitment to meaningful industry change.
The biggest driver was initially the breadth of coverage across gTLDs and ccTLDs, including the subzones and that has only increased with the regular improvements to the service which has been really impressive and valuable to us.
Ultimately, GlobalBlock gives us something significantly more valuable than anything we could have achieved through a defensive registration program. And frankly, defensive registration programs are just not tenable anymore. They don't scale economically or operationally.
TK: What were the other key factors?
Daniel: The economics. Prevention of a domain name from even being registered using domain blocking means we don't have to register it to stop someone else doing it. It's just a much more efficient way of doing it.
Collectively, Meta's GlobalBlock registrations now protect more than 65,000 domain variations. We've also automatically caught more than 60 domains through Priority AutoCatch that weren't available when we first enrolled but were seized on Meta's behalf when they later became available.
And then there's operational simplicity. It's one transaction in one place, but spread out across all these gTLDs and ccTLDs. You don't have to manage individual registrations along with registry and registrar relations and accounts. It's much quicker and simpler.
Observing the Impact
TK: You've had GlobalBlock for 12 months now. What have you noticed?
Daniel: We've observed a pushing away from branded domains for the egregious abuse, the real harms. The threat actors are quick to adapt. The more friction we build into the process, whether they're registering domains that contain our trademarks or variations, the easier they become for us to detect.
We're also seeing less use of core names and more use of what I'd call "random domain names." There are two variations we're seeing. First, the root domain is gibberish, a series of random letters and numbers, but the second, third, or even fourth level subdomain contains the phishing hook, like 'facebook.login.account.help.xR7k9mZq2.xyz'.
The second flavor uses a call-to-action in the root domain, like 'alertcopyrightviolation.com', with our marks buried in subdomains: 'facebook.account.alertcopyrightviolation.com'.
TK: That's actually good in the sense that you're pushing the bad actors further into using less ‘branded’ domains, making it harder and more identifiable by customers.
Daniel: Exactly. It clearly looks like gibberish to a user which is signal to not simply just trust and click. But this is where we need to evolve, either as part of the blocking service or monitoring, to go deeper into the domain structure.
The AI Challenge
TK: This leads us to AI. How does that factor in?
Daniel: AI's power for brand protection is spotting patterns at scale. When domain names cluster with similar patterns, for example 'copyright violation,' 'copyright notification', across different registrars but share TLS certificates, name servers, registration dates, or string similarities, humans can only be so effective at detection.
But an AI model trained on our enforcement data, going back to the inception of our brand protection program, can recognize those patterns and get ahead of attacks before they launch. We're not just reducing time-to-live, we're preventing them entirely.
TK: That ties into what we've been trying to do at the Brand Safety Alliance. GlobalBlock came from listening to brand owners over a five to ten year period: the consistent complaints about portfolios being too big, too expensive, too hard to manage, budget pressures. Now we're hearing about AI, pattern detection, and deeper threat intelligence.
Daniel: The next evolution has to involve registries working together with abuse vendors, marketplaces, and organizations like Meta. What's the next step? I think it's about pattern detection and deeper proactive abuse planning.
TK: What do you see as the biggest emerging challenge?
Daniel: While AI is a force for good, we can expect that it's going to be used equally by bad actors and threat actors. Combine that with the opening of the new gTLD application round, and this threat landscape is just going to grow.
How we collectively address this as an industry is going to have to change. We need a more collaborative and proactive approach across all players: brand owners like Meta, registrars, registries, web hosting, possibly even browsers.
TK: How does AI change the game specifically?
Daniel: You can spin up huge numbers of domains, domain spinning is nothing new. But the ability to create the infrastructure to support those attacks using AI, that's the game changer. Many phishing campaigns are general phishing campaigns using kits people buy off the dark web. You throw out as much as you possibly can, get a small percentage of return, then move on to the next brand or campaign.
AI is only going to increase that velocity.
At the same time, we’ve seen AI amplify our ability to fight against this type of abuse - covering more languages, adding capacity, catching harms more accurately and with more consistency, quickly updating to the latest tactics being used by bad actors, and recognizing patterns that people on their own might miss. While we’re taking a realistic approach to the ways bad actors might try and leverage AI, we’re optimistic about how much AI increases our ability to stay ahead of those bad actors, catching even more of them before the have the chance to do any harm.
TK: We've seen a shift from scammers exclusively targeting big brands to going after mid-market and small businesses. Does that create more vulnerability for your users?
Daniel: Absolutely. With big players getting better at defending themselves and AI reducing the effort required, we're seeing broader attacks. That creates potential vulnerability for people across the internet.
The Circle of Trust
TK: How do these broader threats impact Meta?
Daniel: We expect adversarial threats to persist, and for the bad actors to continue to evolve. Not only in an attempt to evade our detection, but also to avoid enforcement and takedowns. This means that our work also has to continually evolve. Like many brand owners, we are focused on developing and using AI tools that help us to detect and enforce against these attempts to compromise users and our platforms
TK: How does that scrutiny impact your programs for threat detection and brand protection?
Daniel: We're always looking at how we can improve. How can we shorten the time from when a domain is registered to when it goes live, to detecting and taking it down? That's a standard we hold ourselves accountable to, and we're always trying to iterate on it.
The ideal next step is proactively stopping these names before they go live through whatever means are available such as pattern recognition, taking action on clusters of domains, utilizing services like GlobalBlock, and the traditional model of shorter, sharper, quicker detection and takedown methods.
TK: That's quite a responsibility, being one of a handful of companies that are not only the most targeted but also leaders in developing futuristic protection models. What insights would you share with companies that are about to experience what you've learned over the past five years?
Daniel: Question all your assumptions. And never, ever think it's a one-and-done where you can sit back and rest on your laurels because it's a continually evolving landscape.
We work closely cross-functionally with trademarks, marketing, security, anti-phishing, infrastructure, and integrity teams. We're one cog in a huge wheel that's continually monitoring, evolving, and adapting to threat actors.
TK: So you're not living in your silo, you're always engaging with others?
Daniel: We’re always engaging broadly. That's what I would recommend to anybody standing this up or working somewhere that's about to become a bigger, more high-profile company, especially AI companies that are blowing up and getting big very quickly.
It's increasingly not just that brand protection sits over here and security/anti-phishing sits over there. The two are conjoining. They're not two separate worlds anymore. What's the hook that gets people to click on a link? It's the trademark element. But the action that happens after? That's the security element, the anti-phishing element. The two are increasingly being joined at the hip.
Looking Ahead: The Future of Abuse Management
TK: Looking ahead, what would you like to see happen in the industry?
Daniel: What I would like to see is more collaboration across the main pillars of the industry. People need to break out of their silos and start working together, sharing both policies and operational best practices that more effectively combat these threat actors. Everybody's holding a piece of the puzzle.
TK: You're suggesting we might need a different model?
Daniel: I think there's an opportunity for something like what you've done with GlobalBlock: bringing together industry peers around a common goal and finding solutions to the problem of these abusive practices.
TK: Final question: On a more personal note, what legacy do you hope to leave at Meta and in the broader industry?
Daniel: I would really like to change the narrative in the broader domain name industry with the view that people have of Meta.
Ideally, what I would like to leave is an improved collaborative environment with companies like Meta, registrars, and registries, to address abuse and user safety challenges in the domain namespace. Starting to work together to address all of these issues.
We all face shared problems. It's not that the root cause is with social media or with registrars or with registries, it's a shared problem. Once we can all acknowledge that, maybe we could actually start making progress.
TK: That's a powerful vision. Thank you for taking the time to share these insights with us.
Tony Kirsch
