The SnapDragon team investigated the ecosystem of domains hosted on the .shop (‘dot-shop’) extension, which is popularly used for e-commerce websites. However, it has also been noted to be disproportionately utilised by bad actors in the construction of fraudulent sites.
The study looked at the domains containing the names of any of the top ten global luxury brands, with a particular focus on trends and patterns in the set of hosting providers of the set of associated infringing websites. An understanding of these types of issues is key in determining appropriate enforcement strategies and also assessing whether takedown escalation routes or other website disruption techniques may be required.
New Generic Top-level Domain
.shop (‘dot-shop’) is an example of an NgTLD (new generic top-level domain), or domain extension. It launched in 2016, with the intention of providing a ‘dedicated space for e-commerce on the Internet’. However, like many of the new extensions, it has become popular with bad actors for use in the construction of infringing sites – a consequence of low-cost, open availability registrations, and (in this specific case) the obvious association with e-commerce, which lends it to the association with issues such as the sale of counterfeit goods.
.shop in particular has been observed to have a high rate of utilisation by infringers, and has been found commonly to have been featured in domain dispute cases.
Anecdotal evidence from the Commercial and Analyst teams at SnapDragon suggests that .shop domains are disproportionately commonly hosted by particular service providers – such as Beijing Ruihao Kai Yuan Technology Co., part of the network of entities under the management by Georgia-based ISP Malakmadze Web LLC – which tend to have a low compliance to enforcement requests when infringing sites are identified and reported.
As an exploration of the relevant landscape, SnapDragon has carried out a simple study looking at the set of registered .shop domains with names containing any of the top ten global luxury brands.
Analysis of the luxury goods industry in particular can offer valuable insights into the general landscape of infringing e-commerce activity, because of the popularity and relatively high price-point of official goods, and the resulting potential for infringers to attempt to monetise this popularity through the sale of goods associated with infringement of the IP rights of these brands.
The Findings: Domains Containing Luxury Brand Names
Below in the table it shows the total numbers of registered .shop domains with names containing each of the brands in question, noting that – because of the generic nature of the ‘Coach’ brand name specifically – the data has undergone a first stage of filtering in which the domain names were excluded where any other term appears before ‘coach’ in the name, or where the term ‘coaching’ appears explicitly, as a way of focusing the results on those most likely to be referencing the brand specifically.
Even then, the data (particularly for the Coach brand) will still include some non-relevant ‘false positives’ (e.g. in that case, those websites relating to coaching as a service offering); in a live client service, the presence of these non-relevant results would require an additional level of proactive filtering to retain only those examples relating to the brand and/or relevant content.
Brand term | No. domains |
cartier | 14 |
chanel | 220 |
coach | 577 |
dior | 334 |
gucci | 348 |
hermes | 277 |
laurent | 101 |
rolex | 513 |
tiffany | 138 |
vuitton | 23 |
Table 1: Numbers of registered .shop domains containing the names of each of the top ten global luxury brands (excluding clearly non-relevant cases for ‘coach’)
Subsequent Phase of Analysis
The subsequent phase of analysis involved the use of simple automated scripts to inspect the content of any associated live website (if present), and to extract domain configuration information – with a specific focus on the host IP address and the associated web-hosting provider. A next round of filtering was also carried out to exclude (where this information was clear from the analysis carried out) any domains which are officially owned by the brand in question, or any formerly infringing sites which have been taken down and reclaimed by the brand.
Of the remaining (1,871) domains, 756 (i.e. 40%) were found to return some sort of live website response (technically, an HTTP status code of ‘200’), with the remainder (1,115) existing in some sort of ‘dormant’ state (potentially with the intention of being activated at a later date). However, even amongst this set, 252 (23%) were found to have active MX (mail exchange) records, indicating that they have been configured to be able to send and receive e-mails, and could therefore potentially be associated with active e-mail based campaigns.
From the set of live websites, the focus was then on those for which an explicit website title had been configured, and then identified the subset of those with websites which were actively infringing the brand name in question – in most cases, through the sale of physical goods – rather than: (a) referencing the name in some other way (e.g. as a personal name, which is commonly the case for ‘Chanel’, for example); (b) featuring the brand as a sub-string in an unrelated term (e.g. examples such as ‘cardiorelief’, which contains ‘dior’ within it); or (c) where the website features lower-threat content such as a placeholder page (though even in these cases, it is common for the sites to be monetised through the inclusion of pay-per-click links). This analysis thereby also explicitly excludes consideration of other types of infringement, such as traffic misdirection – such as a range of identified domains with names of the form ‘hermesNNNLL’ (N = number, L = letter), which were found to resolve to online gambling sites.
On this basis, the above analysis identified a set of 21 of the highest-risk domains, serving as a representative subset of the landscape of .shop domains which are actively being used for websites infringing the brand in question.
Figure 1: Examples of live e-commerce websites on .shop domains infringing any of the top ten global luxury brands
Understanding These Types of Landscape Issues
The distribution of website hosting providers represented within this set of 21 high-risk .shop domains is shown in Table 2. Whilst the appearance of some of the mainstream hosting providers (such as Amazon, Hostinger and Shopify) in the list isn’t surprising given the large numbers of domains under their infrastructure generally, the inclusion of some of the other entities – especially those which are much smaller operators – may provide an indication in some cases that these providers might be disproportionately commonly associated with infringing activity.
It is particularly noteworthy that Beijing Ruihao Kai Yuan Technology Co., the entity which initially prompted the investigation, appears in five of the 21 cases (24%).
Hosting provider | No. domains |
Beijing Ruihao Kai Yuan Technology Co. | 5 |
Amazon.com, Inc. / Amazon Technologies Inc. | 4 |
Hostinger International Ltd. / Hostinger US | 4 |
Shopify, Inc. | 3 |
Framer B.V. | 1 |
Tilda Publishing NOC | 1 |
Cogent Communications, LLC | 1 |
UltaHost Inc | 1 |
SAKURA Internet Inc. | 1 |
Table 2: Distribution of website hosting providers within the set of 21 .shop domains actively being used for websites infringing the brand in question.
An understanding of these types of landscape issues can be key in constructing an effective enforcement strategy for dealing with infringements. Particularly in cases where the associated domain registrar (i.e. the company through which the domain name in question was originally registered) is also non-compliant – with certain registrars having a policy of denying responsibility for website content – it is important to have escalation routes available.
It is worth noting that GMO Registry, the organisation which manages the .shop extension, has published an acceptable use policy which explicitly prohibits ‘trademark or copyright infringement, [or] fraudulent or deceptive practices’ and references website suspension as one possible consequence of violations. However, in cases where initial takedown efforts are unsuccessful, it is often worth exploring other simultaneous approaches to disrupt the activity of the websites in question, such as search-engine delistings and payment-gateway suspensions.
Want to see how SnapDragon’s AI can protect your brand?
If you would like to explore how SnapDragon can accelerate your online brand protection, safeguarding all your valuable brand assets, get in touch to schedule a demo.
We would love to hear from you, show you what’s possible, and get you protected.
Get in touch today.
