An illustration of the link between real world events and online offenses


In the run-up to the postponed Euro 2020 football championships, we analyzed historical trends in registrations in fields containing the terms “euro2020” or “euro2021”.

A number of past studies – examining events as diverse as the COVID pandemic1, 2, the annual shopping events of the holiday season3, 4, and US retailer GameStop’s share price manipulation Reddit campaign – show a link between real-world events and spikes in online activity. The reason for this correlation is simple: increased public awareness and internet searches for a particular event mean that a range of entities (both legitimate and otherwise) are creating related web content to take advantage of the rise in prices. interest levels and, therefore, web traffic.

The Euro 2020 competition was originally scheduled for June-July 2020, but in March 2020 organizers announced they would delay the event for a year due to the COVID-19 pandemic.5. While the competition is officially known as Euro 20206, there are also a number of unofficial references to the competition under the name “Euro 2021”.

In this study, we looked at a set of related domains that were active in May 2021. The analysis covered 379 domains and initially looked at the registration dates of those domains (Figure 1).

Figure 1: Monthly domain registrations7 containing “euro2020” or “euro2021”, based on 379 active domains (as of May 20, 2021).

A number of observations are obvious:

  • Euro2020 domain registrations began long before the original event dates, with continued activity levels since at least the start of 2019.
  • There was a sharp increase in registrations of “euro2021” domains in March 2020, possibly in response to the announcement of the postponement of the competition.
  • Domain registrations (for “euro2020” and “euro2021” started increasing from March 2021, as the rescheduled tournament dates approach. Although this may be, in part, a data artifact related to the fact that newly registered domains are more likely to be still active at the time of the scan (compared to older registrations, which may have expired before the study was completed), an increase in activity as the event is approaching is consistent with our findings in other studies.

Overall, domains are associated with a number of different types of content. Certainly, some of the websites are likely to be legitimate, for example containing event-related information, material related to official promotions and sponsorships, and sites selling legitimate merchandise. However, others were likely created by bad actors seeking to capitalize on the interest generated by the event to sell counterfeit products, collect user credentials through phishing sites, solicit payment for bogus. tickets or driving web traffic to non-legitimate gambling sites (Figure 2). Some entities may also simply register domain names of potential interest and download pay-per-click links to convert web traffic into revenue.

Of the 379 domain names analyzed, 10% contained keywords related to the game (“bet”, “odds” or “draw”), 3% contained the word “ticket” and 1% contained keywords explicitly linked to electronic commerce (“shop”, “store” or “merchandise”).

Figure 2: Examples of potentially infringing websites containing “euro2020” or “euro2021” in the domain name: (a) an e-commerce site selling goods; (b) a site offering the sale of event tickets; (c) a site promoting game-related content; (d) a site offering the streaming of video content related to an event.

Such activity affects a range of brand owners. When trademarks are used to claim affiliation or imply endorsement on non-legitimate sites, owners of trademarks associated with the contest or brands offering sponsorship or legitimate merchandise may suffer reputational damage and financial loss. These losses can be direct – in the case of phishing-related activity leading to the theft of customer funds – or indirect, for example through misallocation of revenue to sites selling counterfeit goods.

Therefore, it is important that brand owners monitor harmful content and initiate enforcement action on content that infringes their intellectual property. As the rescheduled competition draws closer, we are likely to see continued and potentially increasing levels of a range of offenses, for which there are many monitoring options.

Domain registrations are likely to continue to be an important channel for breaches, and activity trends can be followed through analysis of zone files. Many registry organizations that oversee the infrastructure for a particular Top Level Domain (TLD) regularly publish zone files. These are digital files containing lists of all domains registered in the TLD in question. A trademark protection analyst can download and analyze them daily and, by comparing each file with the previous day, identify new areas, usually within a day or two of registration.

E-commerce in online marketplaces is also expected to experience a significant spike, with offerings of non-legitimate and counterfeit products and merchandise likely to be the primary concern for brand owners. The brand protection analyst should also be able to analyze market trends through real-time analysis of activity by directly researching the spectrum of markets online. This allows us to identify listings that contain keywords of event, brand, and product interest.

As we move towards the launch of the Euro 2020 competition in June 2021 and beyond, the scale and scale of the emerging problem remains to be seen.


About Author

Comments are closed.