counterfeit webshops on TLDs

[Giovane Moura]

Folks,

We've been busy over the last few years with identifying and removing
domain names hosting counterfeit webshops on our zone (.nl). We have now
documented our experience in an academic paper[1] and also now on Ripe
Labs blog[2].

The issue is that many people fall for these websites (which advertise
typically 60%+ discounts), only to end up receiving a counterfeit,
low-quality product, and then are left to deal with their financial
losses. And these shops may 'fly under the radar' for years, given they
do not raise red flags as phishing domains, but still they may incur
significant losses.

We share our experience in two controlled experiments that we run since
2017, and ultimately took down 4455 of those domains. To be fair, we are
not the first ones to identify these shops: Wang et. al[3]  carried out
a comprehensive study on the topic, but used search engine results as
input data and focusing on search engine optimization.

We, however, argue and show how TLDs provide a great vantage point to
identify and possibly remove such websites _in bulk_.

Some folks here may have had had similar experiences (e.g, .de took down
16,000 of those last year[4]), and others may consider taking a look on
their zones.

thanks,

/giovane
SIDN Labs

[1]
https://www.sidnlabs.nl/downloads/6tIo0U3dqydRSP781LYgDP/3c1bea3394648c44e5ea155f7e3f0887/Counterfighting_Counterfeit_detecting_and_taking_down_fraudulent_webshops_at_a_ccTLD.pdf


[2]
https://labs.ripe.net/Members/giovane_moura/detecting-and-taking-down-fraudulent-webshops-at-a-cctld

[3] https://conferences2.sigcomm.org/imc/2014/papers/p359.pdf

[4]
https://www.tagesschau.de/wirtschaft/fakeshops-plagiate-sneaker-china-101.html