In the run-up to the postponed Euro 2020 football championships, we’ve analyzed historical registration trends in domains containing the terms “euro2020” or “euro2021.”

A number of previous studies—looking at events as diverse as the COVID pandemic^{1, 2}, the annual holiday season shopping events^{3, 4}, and the Reddit campaign relating to the manipulation of the stock price of U.S.-based retailer GameStop—show a link between real-world events and spikes in online activity. The reason for this correlation is simple: increased public awareness and internet searches for a particular event means a range of entities (both legitimate and otherwise) create related web content to take advantage of the uptick in interest levels, and correspondingly, web traffic.

The Euro 2020 competition was originally scheduled for June-July 2020, but in March 2020, the organizers announced they would delay the event by a year due to the COVID-19 pandemic⁵. While the competition is known formally as Euro 2020⁶, there are also a number of unofficial references to the competition as “Euro 2021.”

In this study, we looked at a set of related domains active in May 2021. The analysis covered 379 domains, and initially looked at the registration dates of these domains (Figure 1).

A number of observations are immediately apparent:

• Registrations of “euro2020” domains began well in advance of the original event dates, with ongoing activity levels from at least the start of 2019.
• There was a large spike in “euro2021” domain registrations in March 2020, presumably a response to the competition’s postponement being announced.
• Domain registrations (for both “euro2020” and “euro2021”) started ramping up from March 2021, as the dates of the rescheduled tournament approached. Although this may be, in part, a data artefact related to the fact that recently registered domains are more likely to still be active at the time of analysis (compared with older registrations, which may have lapsed before the study was carried out), an increase in activity as the event draws closer is consistent with our findings in other studies.

Overall, the domains are associated with a number of different content types. Certainly, some of the websites are likely to be legitimate, for example featuring information relating to the event, material linked to official promotions and sponsorships, and sites selling legitimate merchandise. However, others are likely to have been created by bad actors looking to capitalize on interest in the event to sell counterfeit products, collect user credentials through phishing sites, solicit payment for fake tickets, or drive web traffic to non-legitimate gambling websites (Figure 2). Some entities may also simply register domain names of potential interest and upload pay-per-click links to convert web traffic into revenue.

Of the 379 domain names analyzed, 10% were found to contain gambling-related keywords (“bet,” “odds,” or “sweepstake”), 3% contained the word “ticket,” and a further 1% contained keywords explicitly related to eCommerce (“shop,” “store,” or “merchandise”).

Such activity affects a range of brand owners. Where brands are used to claim affiliation or imply endorsement on non-legitimate sites, owners of trademarks associated with the competition, or brands providing sponsorships or legitimate merchandise may see reputation damage and financial losses. These losses may be direct—in the case of phishing-related activity resulting in theft of customer funds—or indirect, like through revenue misdirection to sites selling counterfeits.

Consequently, it’s important for brand owners to monitor for damaging content, and launch enforcement actions on material that infringes their intellectual property. As the rescheduled competition draws closer, we’re likely to see ongoing and potentially increasing levels of a range of infringements, for which there are numerous monitoring options.

Domain registrations are likely to continue to be a significant channel for infringements, and activity trends can be tracked through zone file analysis. Many of the registry organizations that oversee the infrastructure of a particular top-level domain (TLD) will regularly publish zone files. These are digital files containing lists of all registered domains across the TLD in question. A brand protection analyst can download and analyze these daily, and by comparing each file with that of the previous day, identify new domains, typically within a day or two of them being registered.

eCommerce on online marketplaces is also likely to see a significant spike, with offers of non-legitimate, counterfeit products and merchandise likely to be the main concern for brand owners. The brand protection analyst should also able to analyze marketplace trends via real-time analysis of activity by searching the spectrum of online marketplaces directly. This enables us to identify listings containing event, brand, and product keywords of interest.

As we move towards the launch of the Euro 2020 competition in June 2021 and beyond, the full size and scope of the emerging problem remains to be seen.