Introduction 

As we approach the start of this year’s holiday shopping season, dominated by the Chinese-focused Singles’ Day (11/11) and the western Black Friday and Cyber Monday events (this year on 29-Nov and 02-Dec) – but also including platform-specific promotions such as Amazon Prime Day(s) and the general ramp-up in spending towards December – we conduct a revisit of last year’s analysis[1] looking at the registration of related domain names.

The holiday shopping period provides an opportunity for brand owners and infringers alike, to take advantage of increased levels of online spend and related searches to drive consumers to their own content. As part of this initiative, many will register specific domain names related to the events in question, and in this study, we consider the landscape of such domains.

Landscape data overview and deep-dive

As of the date of analysis (11-Oct-2024), zone-file searches revealed the existence of 6,667 active registered domains with names containing ‘black(-)friday’, ‘cyber(-)monday' or ‘singles(-)day’ (hereafter referred to as ‘holiday shopping’ domains). The analysis also focuses only on gTLD domains, likely to be most relevant to the landscape of potential infringements (in view of their typical lower cost and lower levels of registration restrictions). Of these, 519 were disregarded from further analysis on the basis of being registered via enterprise-level corporate registrars and thereby most likely to be representing legitimate brand promotions.  

Within the remainder of the dataset[2], a range of domain ages are represented, with the oldest registrations dating back to 2001. However, the striking regional cycle of activity noted in the previous study continues to be apparent, with the vast majority of the domains registered in the latter half of each year, in the run-up to the season in question (Figure 1). The apparent drop-off and smaller size of the 2024 peak is likely to be an artefact resulting from the fact that the analysis was carried out early in October, and so the final data point represents a (greatly) incomplete month; the numbers for the previous months do actually show a year-on-year increase (08-2023 = 33; 08-2024 = 36; 09-2023 = 91; 09-2024 = 98).

[1] https://www.iamstobbs.com/opinion/web-dot-coms-but-once-a-year-holiday-shopping-activity-part-1-black-friday-domains

[2] Considering those where domain registration dates are available via an automated whois look-up

Figure 1: Numbers of active holiday shopping domains (as of 11-Oct-2024), by original month of registration 

Considering specific indicators of the likely nature of activity of the domains within the dataset we find that:  

• 1,887 of the set of 6,148 (i.e. 28%) return some sort of live website response   

• 1,031 (i.e. 55% of the live sites) include at least one high-risk keyword or other term (‘login’, ‘shop’, ‘store’, ‘discount’, ‘replica’, or ‘cheap’) indicating that the primary focus of the website is (potentially non-legitimate) e-commerce  

• 2,461 (i.e. 40%) feature active MX records – indicating that the domain has been configured to be able to send and receive e-mails – meaning that, even in the absence of a live website, the domain may be associated with phishing or other types of e-mail-based scams 

• Considering the domain extensions within the dataset (i.e. the top-level domains, or TLDs), six of the top ten are new gTLD extensions, which have previously been noted as disproportionately being associated with infringing use (#2 .site (387 domains), #4 .shop (208), #5 .today (153), #6 .online (148), #8 .click (90), #10 .xyz (73)).  

Conducting a deeper dive into the dataset, it seems to be the case that a smaller proportion of the sites are directly targeting specific individual brands (either through the inclusion of brand terms in the domain names themselves, or of brand references in the site content) than in previous years, although some such examples were identified (Figure 2).  

Figure 2: Examples of holiday shopping domains resolving to apparently infringing websites targeting specific brands 

Much more common are examples of generic e-commerce sites, in some cases targeting multiple different brands (‘multi-brand’ sites) (Figure 3), examples of sites giving general shopping or product information, linking to specific marketplaces (presumably as part of affiliate promotions), or referencing potentially unofficial coupon or voucher codes.  

Figure 3: Examples of holiday shopping domains resolving to multi-brand e-commerce sites 

A striking new emergence this year – perhaps a reflection of the current economic landscape – are the large numbers of websites using the holiday period to promote their own ‘payday-loan’-style offerings (Figure 4). 

Figure 4: Examples of holiday shopping domains resolving to websites offering ‘payday loans’ 

Summary and key points 

Overall, this data review shows that there continues to be a significant amount of illegitimate online activity targeting consumers and, in many cases, abusing trusted household brands. At times of increased numbers of infringements, it becomes all the more important for brand owners to monitor the landscape and conduct proactive programmes of takedowns against egregious findings, as part of a comprehensive brand protection initiative. Of course, domain registrations are only part of the picture; as the boundaries between online channels become increasingly blurred, monitoring initiatives must take also account of a range of platforms, including e-commerce marketplaces (including the increasingly large numbers of product- and region-specific examples), social media, mobile apps, and other general Internet content. This will help brands to protect consumers from infringement types such as counterfeiting and phishing, including examples making use of trending techniques such as hidden links[3]. Brand protection teams may wish to bear such issues in mind when deciding where and how much resource to allocate this coming holiday shopping season.

[3] https://circleid.com/posts/20220510-breaking-the-rules-on-counterfeit-sales-the-use-of-hidden-links