Home / Blogs

Euro 2020: An Illustration of the Link Between Real-World Events and Online Infringements

In the run-up to the postponed Euro 2020 football championships, we've analyzed historical registration trends in domains containing the terms "euro2020" or "euro2021."

A number of previous studies — looking at events as diverse as the COVID pandemic1, 2, the annual holiday season shopping events3, 4, and the Reddit campaign relating to the manipulation of the stock price of U.S.-based retailer GameStop — show a link between real-world events and spikes in online activity. The reason for this correlation is simple: increased public awareness and internet searches for a particular event means a range of entities (both legitimate and otherwise) create related web content to take advantage of the uptick in interest levels, and correspondingly, web traffic.

The Euro 2020 competition was originally scheduled for June-July 2020, but in March 2020, the organizers announced they would delay the event by a year due to the COVID-19 pandemic5. While the competition is known formally as Euro 20206, there are also a number of unofficial references to the competition as "Euro 2021."

In this study, we looked at a set of related domains active in May 2021. The analysis covered 379 domains, and initially looked at the registration dates of these domains (Figure 1).

Figure 1: Monthly domain registrations7 containing "euro2020" or "euro2021," based on 379 active domains (as of May 20 2021).

A number of observations are immediately apparent:

  • Registrations of "euro2020" domains began well in advance of the original event dates, with ongoing activity levels from at least the start of 2019.
  • There was a large spike in "euro2021" domain registrations in March 2020, presumably a response to the competition's postponement being announced.
  • Domain registrations (for both "euro2020" and "euro2021") started ramping up from March 2021, as the dates of the rescheduled tournament approached. Although this may be, in part, a data artefact related to the fact that recently registered domains are more likely to still be active at the time of analysis (compared with older registrations, which may have lapsed before the study was carried out), an increase in activity as the event draws closer is consistent with our findings in other studies.

Overall, the domains are associated with a number of different content types. Certainly, some of the websites are likely to be legitimate, for example featuring information relating to the event, material linked to official promotions and sponsorships, and sites selling legitimate merchandise. However, others are likely to have been created by bad actors looking to capitalize on interest in the event to sell counterfeit products, collect user credentials through phishing sites, solicit payment for fake tickets, or drive web traffic to non-legitimate gambling websites (Figure 2). Some entities may also simply register domain names of potential interest and upload pay-per-click links to convert web traffic into revenue.

Of the 379 domain names analyzed, 10% were found to contain gambling-related keywords ("bet," "odds," or "sweepstake"), 3% contained the word "ticket," and a further 1% contained keywords explicitly related to eCommerce ("shop," "store," or "merchandise").


Figure 2: Examples of potentially infringing websites containing "euro2020" or "euro2021" in the domain name: (a) an eCommerce site selling merchandise; (b) a site offering the sale of event tickets; (c) a site promoting gambling-related content; (d) a site offering streaming of event-related video content.

Such activity affects a range of brand owners. Where brands are used to claim affiliation or imply endorsement on non-legitimate sites, owners of trademarks associated with the competition, or brands providing sponsorships or legitimate merchandise may see reputation damage and financial losses. These losses may be direct — in the case of phishing-related activity resulting in theft of customer funds — or indirect, like through revenue misdirection to sites selling counterfeits.

Consequently, it's important for brand owners to monitor for damaging content, and launch enforcement actions on material that infringes their intellectual property. As the rescheduled competition draws closer, we're likely to see ongoing and potentially increasing levels of a range of infringements, for which there are numerous monitoring options.

Domain registrations are likely to continue to be a significant channel for infringements, and activity trends can be tracked through zone file analysis. Many of the registry organizations that oversee the infrastructure of a particular top-level domain (TLD) will regularly publish zone files. These are digital files containing lists of all registered domains across the TLD in question. A brand protection analyst can download and analyze these daily, and by comparing each file with that of the previous day, identify new domains, typically within a day or two of them being registered.

eCommerce on online marketplaces is also likely to see a significant spike, with offers of non-legitimate, counterfeit products and merchandise likely to be the main concern for brand owners. The brand protection analyst should also able to analyze marketplace trends via real-time analysis of activity by searching the spectrum of online marketplaces directly. This enables us to identify listings containing event, brand, and product keywords of interest.

As we move towards the launch of the Euro 2020 competition in June 2021 and beyond, the full size and scope of the emerging problem remains to be seen.

By David Barnett, Brand Monitoring Subject-Matter Expert at CSC – David Barnett has worked in the internet brand-protection industry as an analyst and consultant since 2004. David managed the Analysis & Consultancy services in Brand Monitoring from 2006 to 2019, and currently works as the Brand Monitoring subject-matter expert in CSC's office in Cambridge, U.K., helping to serve a range of brand-protection customers in a variety of industries. Visit Page

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

VINTON CERF
Co-designer of the TCP/IP Protocols & the Architecture of the Internet

Comments

 Be the first to post a comment!

Add Your Comments

 To post your comments, please login or create an account.

Related

Topics

Threat Intelligence

Sponsored byWhoisXML API

Cybersecurity

Sponsored byVerisign

Brand Protection

Sponsored byAppdetex

IPv4 Markets

Sponsored byIPXO

Domain Management

Sponsored byMarkMonitor

Domain Names

Sponsored byVerisign