{"id":13483,"date":"2024-08-01T16:55:56","date_gmt":"2024-08-01T20:55:56","guid":{"rendered":"https:\/\/www.cscdbs.com\/blog\/?p=13483"},"modified":"2026-01-15T10:02:38","modified_gmt":"2026-01-15T15:02:38","slug":"paris-2024-olympic-games-navigating-the-hurdles-of-fraud-scams-ip-infringement-and-brand-threats","status":"publish","type":"post","link":"https:\/\/www.cscdbs.com\/blog\/paris-2024-olympic-games-navigating-the-hurdles-of-fraud-scams-ip-infringement-and-brand-threats\/","title":{"rendered":"Paris 2024 Olympic Games: Navigating the Hurdles of Fraud Scams, IP Infringement, and Brand Threats"},"content":{"rendered":"\n
Although the Olympic games have yet to transcend to the digital realm and include internet-based sports, the online arena still poses a significant threat to world events like the Olympics that are always targeted by bad actors and fraudsters. From counterfeit items to fake tickets, to phishing scams, bad actors will be using the Olympics\u2019 worldwide status and recognition to dupe people.<\/p>\n\n\n\n
As a starting point to an extensive catalogue of avenues for exploitation at the Paris Olympics, brands and domain names will primarily be used in cyberattack campaigns, impersonations, fraud scams, and brand counterfeiting. Monitoring domain ecosystems globally\u2014such as domain names that are look-a-like, dropped, re-registered, or newly registered\u2014should be at the forefront of any corporate security posture and brand\u2019s online strategy toward mitigating these digital threats.<\/p>\n\n\n\n
As the Paris 2024 Olympic games draw near, CSC has undertaken research into domain name behaviors surrounding the games and has detected a surge of domain activity. Using CSC\u2019s 3D Domain Security and Enforcement product that is powered by the one-of-a-kind DomainSecSM <\/sup>platform that harnesses Machine Learning Deep Search (MLDS) technology, we\u2019ve examined this activity in succinct detail to fully understand the extent of the recent domain name activities and conducted trend analysis. In short, we\u2019ve removed any hurdles\u2014pun intended\u2014in understanding domain behavior that may put major brands at risk during this season\u2019s Olympic games.<\/p>\n\n\n\n
<\/div>\n\n\n\n
What we found<\/strong><\/h2>\n\n\n\n
We identified over 8,087 domain names in relation to the term \u201cOlympic\u201d within the past 12 months. A total of 7,568 domain names were registered within generic top-level domains (gTLDs) and 509 domain names within country code top-level domains (ccTLDs). The distribution within gTLDs was: .COM received 4,806, .ORG received 483, and .NET 203. Moreover, interesting extensions such as .ONLINE received 203, .XYZ received 145, .SITE received 104, .SHOP received 102, and .GAMES received 29. Drilling down further using the search term \u201cparis2024,\u201d we uncovered more than 400 domain events within the same timeframe\u2014a high number compared with other branded results, and roughly in line with what we\u2019d expect to see from other world events of this type.<\/p>\n\n\n\n
As CSC\u2019s 3D Domain Security and Enforcement technology uses unique search models such as homophones, fuzzy matches, and homoglyphs, results are not limited to the parameters of identical domain name matches, and we can view the domain name ecosystem in its entirety. This means we were able to uncover results like \u201cpares2024.org\u201d (typo and homophone) and \u201cp\u00c3\u00a5ris2024.org\u201d (homoglyph)\u2014tactics frequently used by bad actors, indicating a potential to launch fraudulent campaigns. Furthermore, 3D technology also allows us to view results using language variations of \u201colympic.\u201d Using these search parameters, we were able to broaden our search further, finding more than 30 domain events with the keywords \u201colympic,\u201d \u201colympique\u201d (French), \u201colympie\u201d (Czech), or \u201colimpic\u201d (Romanian) used in combination with the original search term \u201cparis2024.\u201d<\/p>\n\n\n
\nFigure 1: Domain activity for the key term \u201cparis2024\u201d from March 27, 2023 to March 26, 2024.<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n
Figure 1 above shows that 63% of the domains with the key term \u201cparis2024\u201d are newly registered domains, 29% of those names registered within the year had been dropped, and 8% re-registered. Companies defensively register critically important domain names to prevent online fraud but for various reasons, they decide to drop domains, or let them lapse. Cybercriminals wait for this to happen and immediately re-register the same domain name for malicious purposes. They\u2019re constantly on the lookout for available, branded domains they can weaponize.<\/p>\n\n\n\n
Further scrutiny of the domain name datasets revealed an outlier, detected on March 12, 2024. As Figure 2 shows, over 55 domain registrations took place that day using variations of \u201cparis2024.org.\u201d Such data spikes are significant as they follow the patterns of fraudulent campaigns that are launched at a later time by bad actors. Further analysis has determined that these domains all presently resolve to parking pages with sponsored links, use a matching registrar, and include identical A Records (in some cases). Moreover, since the same hacked infrastructure is being used to launch future fraudulent campaigns, it\u2019s a clear indication that the same bad actors are behind such domain name registrations. Finding these kinds of trends in data is paramount in understanding the movement of the domain name landscape and identifying any potential threat vectors.<\/p>\n\n\n
\nFigure 2: Domain activity from March 27, 2023 to March 26, 2024 for key term \u201cparis2024.\u201d<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n
Also in our analysis, we uncovered a subset of approximately 15 domains referencing sponsors of the Paris Olympics with the core search term \u201cParis 2024.\u201d We advise brand owners that are sponsors of large world events like this to add keyword strings related to the event to their daily domain name monitoring programs.<\/p>\n\n\n\n
Finally, from the identified domains, we detected the highest volume of domain registrations relating to Paris 2024 for the .COM TLD. This was followed by .ORG and .FR in silver (second highest volume) and bronze (third highest volume) places. All these factors are critical in analyzing any potential domain name threat vectors related to the upcoming Olympics, as they assist our understanding of whether the intention behind the domain name registration is legitimate or not.<\/p>\n\n\n\n
<\/div>\n\n\n\n
Further analysis<\/strong><\/h2>\n\n\n\n
A deeper domain name analysis is used to determine whether a domain name is dormant or fraudulent. A dormant domain name is defined as one that is not weaponized with a type of threat vector while a fraudulent domain name is one that has been weaponized with a threat vector, such as phishing or malware. Domain names registered with mal-intent include: domains with a risk level of the secure sockets layer (SSL) certificate used, domain MX records detected, domain keyword, web page content analysis, and proxy services used, shady hosting provider or registrars used, and many other potential indicators of compromise. For example, the re-registration of the domain \u201cparis2024.media\u201d\u2014which currently redirects to \u201cbestbettingsites.com\u201d and features Olympic games branding (Figure 3)\u2014was uncovered by assessing the risk profile of the SSL certificate, which flagged a need for further deeper analysis. Moreover, dormant domain names that don\u2019t resolve to any content, but have active MX records (e.g., olympicgamesparis2024.shop) are also of vital importance in analysis. The presence of MX records on a domain can indicate that it may be weaponized in the future for a phishing or malware campaign, or other fraudulent activity.<\/p>\n\n\n
\nFigure 3: Screenshot of \u201cparis2024.media\u201d re-directing to \u201cbestbettingsites.com.\u201d Note the use of Olympics imagery\u2014an IP infringement.<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n
<\/div>\n\n\n\n
What are the takeaways for brand owners?<\/strong><\/h2>\n\n\n\n
Our analysis identified a large number of domain events using \u201cOlympic\u201d within the past 12 months, plus 400 including the keyword \u201cparis2024,\u201d and 30 using language variations. But what can brand owners take from what we found?<\/p>\n\n\n\n
![\"\"](\"https:\/\/cscwebcontentstorage.blob.core.windows.net\/cscmarketing-cscdbs-media\/images\/Figure%201%20Domain%20activity%20for%20the%20key%20term%20%E2%80%9Cparis2024%E2%80%9D%20from%20March%2027%2C%202023%20to%20March%2026%2C%202024..png\")
![\"\"](\"https:\/\/cscwebcontentstorage.blob.core.windows.net\/cscmarketing-cscdbs-media\/images\/Figure%202%20Domain%20activity%20from%20March%2027%2C%202023%20to%20March%2026%2C%202024%20for%20key%20term%20%E2%80%9Cparis2024.%E2%80%9D.png\")
![\"\"](\"https:\/\/cscwebcontentstorage.blob.core.windows.net\/cscmarketing-cscdbs-media\/images\/Paris%20olympics%20blog%20image%203.png\")