Culture

Business websites

.com

Brand protection

Online stores

Hosting

Data privacy

Policy-making

Registrars

Investing & reporting

Internet Basics Series

How to

People

Cybersecurity

Web trends

Tech news

Security

COVID-19

Technology detection

domains

Software

WordPress

TLDs

GDPR

Veronika Vilgis

The .eu TLD is managed by EURid, the European Registry for Internet Domains. It was established to provide a unique European identity on the internet and is available to residents, organizations, and businesses based within the European Union, as well as in Iceland, Liechtenstein, and Norway. This is monitored by the registrar—the organization that facilitates connecting a chosen domain name to a chosen TLD—who collects information about the registration depending on the TLD restrictions. For the .eu case, registrar GoDaddy requires address validation at registration:

This already shows a point of contention: the registrars say upfront that UK addresses are not allowed. But how did this happen, and where do we go from here?

The UK's official withdrawal from the European Union on January 31, 2020—popularly known as Brexit—set in motion a series of changes for .eu domain holders based in the UK. These changes were implemented in stages:

From January 1, 2021, UK residents and organizations became ineligible to register new .eu domains. This swift effect of Brexit closed off a previously available option for UK entities seeking to establish a European online presence.

On January 1, 2021, existing .eu domains registered to UK addresses were suspended. This meant that while the domains still existed, they ceased to function, potentially causing significant disruption to businesses and individuals relying on these domains for their online presence. The idea was that most UK-based .eu domains would transfer before this date, but for various reasons, this was not universally possible or accomplished. 

Following the suspension period, all suspended .eu domains registered to UK addresses were withdrawn on January 1, 2022. These domains became available for general registration three months later, on April 1, 2022, for registrants with a validated EU address. This final step effectively removed these domains from UK registrants, unless they had taken specific actions to maintain eligibility.

What happened next? Consequences for UK-based domain registrants

Losing a domain can lead to various complications for businesses. Legal and contractual issues may arise when legal documents reference the domain, necessitating updates and potential renegotiations. For businesses that use the domain for their email addresses and communication channels, the loss of the domain may cause major interruptions and loss of contacts or conversations. Equally, if a domain owner has spent time and money on search engine optimization and marketing efforts tied to a domain, this effort may be lost and requires a complete rebuild of an online presence. Branding and recognizability can also suffer from a forced switch like this: domain owners may lose their online identity having to trade for a less catchy domain name with another TLD, especially if their original name is not available. It’s easy to see that ‘vanman.eu’, for example, sounds a lot more authentic and authoritative than aberdeenvanman.com.

To maintain their .eu domains, UK registrants were pushed to take one of two actions. 

Establish EU citizenship: registrants would be required to change and provide evidence of residency or citizenship in another EU member states. 

Transfer ownership: UK registrants could transfer ownership of their .eu domains to EU-based subsidiaries or partners.

The case of “leave.eu”, though the domain is no longer active, provides a notable example of the Brexit impact. This pro-Brexit campaign website, ironically, faced the loss of its domain due to Brexit. To maintain their online address, the organization elected to move its registration address to EU-member Ireland—demonstrating the lengths to which some entities (even those who desperately fought for these changes) went to preserve their .eu presence.

For this article, we were not specifically interested in the ones that maintained their domain via the mitigation strategies we mentioned above, but rather those that moved their domain to a new TLD. Where did they go, and were they able to retain their original name?

In the course of our research, we looked at 4,160 active .eu website that were allocated to a UK registrant in December 2020. As you can see in Figure 1, there’s a sharp drop in the returned response—meaning this number of websites are no longer accessible after January 2021. This was obviously expected, given the registry’s post-Brexit policy. Over time, the number continues to drop gradually. The number of UK-registered .eu websites that redirect is 828, and Figure 2 shows the top TLDs these domains redirect to. The majority redirects to a .com domain, followed by .co.uk and then to (another) .eu. Notable is that 46% of the .eu to .com redirecting domains actually redirect to www.sedo.com, a domain parking company,

Next, we were interested to see if the ones that redirect were able to maintain their name. Indeed, we found 276 domains that redirect to the same name, i.e. only the TLD portion changed. The remainders redirect to domains that are not identical to the original, but maintain part of the former name. For examples, see Figure 4. We suspect that in most of these cases the intended, ideal, and original name was not available for registration. In all of these cases, the domain name length increased; common variations included the addition of geographical location, hyphens, or company legal structures (e.g., ltd).

The Brexit-induced changes to .eu domain eligibility have had far-reaching consequences for UK-based registrants. While some were able to adapt by transferring registration to an EU-based country, many faced the loss of their established online identities. This situation underscores the importance of considering geopolitical factors in domain registration strategies and highlights the need for businesses to have contingency plans for their online presence.

Domains

The .eu top-level domain (TLD) was introduced in 2005, and has been a top choice for businesses and individuals across the European Union since then. However, the United Kingdom's departure from the EU has had significant consequences for UK-based .eu domain registrants. Can you have a .eu domain without being in the EU? Well, not technically…

Here, there, and everywhere: tracking UK-owned .eu domains in a post-brexit world

Loura Kruger-Zwart

Navigating the digital landscape is hard enough, let alone introducing the drama and politics of domain names. Throw in nasty behavior and some lawsuits, and you’ve got an introduction to the world of cybersquatting.

Going beyond just simple domain registration, cybersquatting is a complex and evolving practice in the digital landscape. At its core, it involves the bad faith use or registration of domain names, often with the intent to deprive rightful owners or profit from others' trademarks. This practice has expanded to include username- and handle-squatting across online and social media platforms, extending its reach beyond just domain names.

Digital troublemakers have developed a range of techniques and forms of cybersquatting over the years. The traditional form, domain squatting, involves the registration of domain names similar to established brands or trademarks—the registration of netflix-movies.com would be an example. The practice has evolved to include username and handle squatting on social media, meaning that bad actors claim the names resembling known brands or public personalities. Typosquatting, another common technique, involves registering domains with common misspellings of popular websites—think netflux.com or netfllix.com. You can see these in action in Figure 1: there are many ways to manipulate a domain name for cybersquatting purposes.  

Internationalized Domain Name (IDN) cybersquatting utilizes visually similar characters from different scripts to create deceptive domains—netflíx.com looks just like the true domain until you notice the accent on the ‘i’. In Figure 2 we see several real examples of IDN cybersquatting, extracted from the Dataprovider.com database.

The motivations behind cybersquatting are primarily financial or malicious. Many cybersquatters attempt to sell domains to trademark owners at inflated prices, seeking financial gain, while others use these domains for more nefarious purposes, like phishing, scams, malware distribution, or just redirecting to competitor websites. In some cases, cybersquatting is used for political leverage: individuals register domains related to political figures or movements, as seen with cases from Australian senators to US presidential tickets, for negative consequences. These activities create a complex and often problematic ecosystem, affecting businesses, individuals, and the overall integrity of the internet.

Cybersquatting extends across various languages, exploits different top-level domains—like by registering netflix.jp before the company itself can—and employs sophisticated techniques to bypass traditional safeguards. It is absolutely not limited by language or geography. The introduction of new generic TLDs (like netflix.film) has added another layer of complexity to the cybersquatting landscape, both in terms of new opportunities for squatters and new challenges for brand protection. While most cybersquatting is profit-driven, there are non-commercial forms such as cybergriping, where individuals register domain names to criticize or parody organizations: ex-South Park writer Tony Morton is (in)famous for creating spoof websites and using humor to combat hate. However, this raises questions about the balance between free speech and name or brand protection.

At Dataprovider.com, we developed our own system to identify cybersquatting for the top 100,000 websites, based on the traffic they receive and a few other indicators.

Take a look at the number of cybersquatting domains we detect for each of the ten target domains in Figure 3. According to our data, nearly 2,400 domains targeted the main domain of the US based airline United in September 2024, while YouTube.com and 3m.com were targeted by 1,040 and 1,014 cybersquatters, respectively. We also see three major adult sites among the top 10: explicit links are popular targets for cybersquatters because they attract large volumes of traffic, making mistyped or similar domains highly profitable through ads, affiliate links, or redirects. Additionally, adult sites generally face weaker brand protection, allowing cybersquatters to exploit misspelled URLs and monetize them with less resistance from site owners.

Understanding cybersquatting means understanding the domain ecosystem. Key players include ICANN (the Internet Corporation for Assigned Names and Numbers), which governs the domain name system globally, registries that manage top-level domains, and registrars that facilitate the registration of domain names. This ecosystem establishes the backdrop against which cybersquatting occurs. and the foundation on which it can be combatted. 

Legal proceedings, often through the UN’s World Intellectual Property Organization (WIPO), have become a common recourse for companies and individuals fighting cybersquatting. Recent high-profile cases illustrate the complexity of these battles: Canva recently secured 174 domain names through legal proceedings, demonstrating the scale of cybersquatting targeting major brands. Conversely, the case of GigPig highlights the potential for abuse of anti-cybersquatting measures, with the company being accused of reverse domain hijacking. These cases underscore the intricate nature of cybersquatting disputes and the challenges in fairly resolving them.

New elements of brand protection have emerged in response to the threat of (commercial) cybersquatting. Preemptive domain ‘warehousing’ is a common response to these kinds of threats: companies register as many domain variations as they can think of to protect their brand. This proactive approach, while effective, contributes to the saturation of the internet's domain space.

Besides proactive domain management, AI and machine-learning tracking technologies are being developed to help detect cybersquatting. Digital tools and databases—like what we've developed at Dataprovider.com—are solid resources for monitoring particular domain names and identifying cybersquatting attempts. Many businesses implement redirection networks and systems that redirect traffic from similar domains to the legitimate website. There are now more ways to try and mitigate the issue, but it's what happens after the fact that remains an issue. On the legal front, companies and policymakers are utilizing existing laws and pushing for new legislation to address emerging forms of cybersquatting—but it remains a murky and complicated realm. 

As the internet continues to evolve, so too will the challenges and solutions related to cybersquatting. We can expect to see enhanced tracking technologies emerge, offering more sophisticated tools to identify and prevent cybersquatting attempts in real-time. The legal landscape is likely to expand, with the development of more comprehensive international legal frameworks to address cybersquatting across jurisdictions. Maintaining the delicate balance between robust brand protection measures for business, while preserving the principles of fair use and free speech in the digital space, promises to remain a hard task. With the growing popularity of emoji domains and TLD developments, we'll never be rid of the risk, but it's not impossible to keep on top of it. This digital ecosystem challenge will requite ongoing vigilance, technological innovation, and legal adaptations to address its evolving nature and impact on businesses, individuals, and the integrity of the internet as a whole.

Brand Protection

Bad manners, grudges, and name-calling… sounds like playground antics, but this is the online world of cybersquatting. Including domain squatting and typosquatting, this illicit digital activity is usually for malicious, political, or financial gain but is a popular stunt among satirists too. Read on to learn more about cybersquatting and the efforts to combat it.

What is cybersquatting? Preventing domain hijacking and brand misuse

Jasper van Thuijl

Cloudflare’s content delivery network (CDN) is frequently used for websites and web apps to optimize load times and reduce traffic to the origin server. Cloudflare provides a reverse proxy service, which acts as an intermediary service between the host server and the visitors, thereby hiding the origin server. This makes it hard for anyone on the outside to locate the IP address of the origin server and identify the hosting company behind the domain. While this offers protection against cyberattacks such as a denial-of-service attack, it can be a double-edged sword as the gained anonymity can also be used for malicious purposes. 

Using our historical data, we’ve developed a method that can find the origin servers behind Cloudflare-protected hostnames. By making a HTTP request for the website at the origin server, we can verify that the website is still hosted at this location.

We apply our method to 100,000 records that we’ve randomly sampled from the total of approximately five million unique domains that use Cloudflare’s CDN. We find that 30% (~ 30,000 domains) of sampled websites respond with a status code 200 from the origin server, meaning they’re still hosted there. From these websites, around 45% (~ 13,500 domains) are hosted in the US. 

To demonstrate another use case of our method, we’ll now investigate a set of untrustworthy eCommerce websites that use Cloudflare. Our proprietary Trust Grade is based on features such as the presence (or lack) of an SSL certificate, contact information, products, prices and number of changes. After filtering eCommerce websites by a Trust Grade D, E or F, which means their legitimacy is doubtful, we identify nearly 29,000 unique domains that are using Cloudflare and are therefore hiding their IP address and the hosting company behind the domain. 

Each domain that has ever been registered belongs to someone and, in many cases, this information is publicly available. Anyone can obtain this information through the WHOIS protocol, which is helpful when any issue related to a website arises. A large number of domains in our set of suspicious eCommerce websites are anonymous and seem to have used a domain privacy service that obscures the domain ownership records available through WHOIS.

But are these websites truly anonymous, or can we still find out where they’re hosted? After running our method on the dataset, we find that 49% (around 14,000) of Cloudflare-protected shady online stores still respond to requests on their old IP address. Looking at the distribution of hosting companies for the origin servers (Figure 1), we find that one third of these untrustworthy eCommerce websites are hosted by Shopify, followed by Google LLC (10%) and Amazon.com, Inc. (5%).

This makes sense as Shopify is one of the most popular eCommerce platforms. The combination of using Cloudflare while hosting on Shopify, however, doesn't necessarily mean that malicious practices are going on. If we use our platform to look at the complete set of websites hosted on the Shopify platform, we find that while 99% of Shopify websites use Cloudflare’s CDN service, only 1.5% of them are classified with a Trust Grade lower than C.

Next, we take a look at the countries where the servers are located. We find that around 37% of untrustworthy online stores are hosted in the US, followed by Canada with 18%. Figure 2 shows the top 10 hosting countries of the origin servers behind untrustworthy online stores making use of Cloudflare’s CDN.

Fraudulent eCommerce websites pose a serious problem in today’s digital world. The method applied in this article allows us to detect the origin server of domains protected by Cloudflare’s CDN and can be used to track down malicious usage. Our method has helped us uncover a large set of anonymous untrustworthy online stores and get insights into where and by whom they’re hosted, which shows that our method can serve as a useful tool in the fight against cybercrime. 

Sometimes a deal is too good to be true: fake eCommerce websites sell far below the original product price as they actually sell counterfeits or never deliver what you’ve ordered. Since many of these online stores try to be anonymous, it can be hard, or even impossible, to take any legal action. But are they truly anonymous or can we still find out where they’re hosted?

Uncovering the real servers behind Cloudflare-protected domains

Gijs Barends

At Dataprovider.com we came across this phenomenon years ago. At first sight, these websites look like ordinary online stores. But a closer look reveals that there are a number of attributes that are off most of the time.

First, there’s no phone number on the website, just an email form. This is a huge red flag. Most reliable online stores try to make it as easy as possible for prospective customers to contact them in different ways. 

Second, the domain name doesn’t make sense: this is because counterfeiters use domains that previously had a website but for some reason the website owner decided not to renew their domain name, so it expired. But in many cases other websites still have a link to it. For example, a website about the history of New York City might have a link from another website that has an article about New York City. This link still exists even after the website about New York isn’t active anymore, so people are clicking on it. A widely used tactic among infringers is to find and register domains that aren’t renewed. Going back to our example, the people who read the article about New York City and click on it will now visit an infringing website and might be tempted to buy something there. 

Third, steep discounts without a good reason (for example, an end of a season sale) can also be indicative of scam websites. If it's too good to be true, then often that is indeed the case. 

Fourth, websites that use a free SSL certificate can give a false sense of security. As SSL is available at no charge, we’ve seen an enormous increase in the number of websites that are using itL. But SSL is no guarantee that you’re on a legitimate website.

Because this kind of crime only pays off if it’s done on a large scale and in a partly automated way, we see that counterfeiters use specific templates. These are predesigned layouts that enable the website owner to easily fill in and arrange content on a site. This makes it much easier to roll out such a scam on a large scale and also easier for us to identify these sites and even to reveal whole networks exploited by the same owner.  

The infringing websites are hard to recognize at first sight but with a bit of practice it’s actually quite easy, they all work very similarly. Because we index the whole web, it’s possible to make a classifier to recognize them. Our proprietary Trust Grade ranges from A to F: A being the highest grade and F the lowest. Brands and brand protection companies frequently use the Trust Grade to find infringing sites and make sure they are taken offline. 

We thought it would be interesting to analyze what brands are the most recurrent victims of infringement. For this analysis we looked into nine popular sport and sneaker brands: Adidas, Asics, Converse, Diadora, New Balance, Nike, Puma, Reebok and Skechers. We first looked at the number of online stores that sell any of these brands and then at how many of them were classified into a Trust Grade of E or F. 

Looking at the percentages, Skechers and Reebok were the top two brands with a 14% and 10% share of online stores with infringing content. And while Nike (∼30k) and Adidas (∼27k) are by far the largest brands among the ones we’ve examined, only around 8% of stores featuring these brands receive a low Trust Grade. In our analysis, Asics was the brand with the lowest share of untrustworthy eCommerce sites (6%).

Sneaker brands are a popular target for counterfeit criminals. Unfortunately, each famous brand has this problem. Looking at our data, we see that some brands are better at protecting their name than others. Technology makes it possible to find brand infringing networks and take them out, but the bad news is they easily pop back up so it is a continuous problem that requires rigorous monitoring. It will be hard to eradicate this problem entirely.

A problem that virtually each popular brand will face at some point is counterfeiting. In this post we’re going to look at a specific way of counterfeiting: online stores that are created to only sell counterfeit goods.

Follow us

Questions?

Brand protection

Here, there, and everywhere: tracking UK-owned .eu domains in a post-brexit world

What is cybersquatting? Preventing domain hijacking and brand misuse

Uncovering the real servers behind Cloudflare-protected domains

Fake online stores: which sneaker brand do they favor?

Start today