As news of the spread of the coronavirus (COVID-19) continues to emerge, CSC has undertaken the first in a series of studies looking at how the development of the crisis has affected online content. This first article looks at the numbers of registered domains with names containing coronavirus-related strings — “coronavirus” or “covid(-)19” (optional hyphen) — and analyzes the types of content present on the associated websites.
In our investigation, we found 6,341 domains containing the string ‘covid(-)19’, and 11,552 domains containing ‘coronavirus’. Many of these registered domain names include other terms, implying that the associated websites feature neutral or informational content. However, significant numbers incorporate particular keywords suggesting that they could have been registered to take advantage of people’s fears surrounding coronavirus to attract web traffic. These domains may be used to create websites associated with scams, or with the intention of generating revenue.
|Keyword||No. coronavirus-related domains containing keyword|
|anti (excl. “quarantine”)||187|
|Tracking and testing-related keywords:|
|suppl- (for “supply,” “supplies,” or “supplier”)||130|
|Health organization keywords:|
|Total no. domains with keywords (excl. duplicates)||2,646|
We further analysed this set of domains to determine when the domains were registered. This analysis shows that of the 2,000 plus domains for which creation dates were identifiable, only 17 domains (0.8%) were registered before 2020, and 68% (1,400+ domains) were registered since the start of March — that’s just two weeks prior to the date of analysis.
N.B. We truncated the graph at three days prior to the date of analysis, as there can typically be a delay of around two to three days between the date of domain registration and its inclusion and detection in the published zone file. Accordingly, the numbers of registrations shown for (at least) the two or three days prior to analysis are likely to be underestimates.
* * *
These figures provide a striking illustration of how escalating real-world issues can produce a flurry of corresponding activity online, with an enormous increase in registrations as countries began to announce lockdown measures throughout March. We can also see spikes in the domain-registration graph associated with specific events:
- The first announcements of the emergence of coronavirus outside China in late January
- The WHO announcement of COVID-19 as the specific strain on February 11
- The start of Italy’s lockdown in late February
What’s in a domain name?
Nearly 75% of the 2,646 domains with keywords of interest produced a live webpage response. Around three-quarters of these currently don’t point to an active site, i.e., no page title, or a title suggesting that only a holding page is present. That said, even these may have been registered with a goal of monetizing the domain name, either through pay-per-click links on the site or explicitly offering the domain name for sale.
Setting aside inactive domains still leaves around 500 coronavirus-related domains featuring relevant keywords and appearing to host active websites. Thirty-two of that 500 achieve significant web traffic, attracting over 8,000 internet users daily between them. The websites resolve to a range of content, although just over a third resolve to active eCommerce sites offering face masks for sale. Others include eCommerce sites selling coronavirus testing kits or other healthcare products; sites linking to online pharmacies; sites offering global coronavirus tracking functions; and a range of other informational sites.
|Page title||Site content||Daily visitors|
|Covid-19 FaceMask – Anti Corona Mask||eCommerce site: face masks||1,800|
|Mask Machine||eCommerce site: face masks||1,200|
|Treatment for Coronavirus – Latest Information on Corona Causes, Symptoms & Treatment||Site promoting an online pharmacy||990|
|2019 Coronavirus Tracker – About||Informational blog site||600|
|COVID-19 Tracker||Site offering a case-tracking service||600|
|Corona Virus Mask | Corona Virus Mask||eCommerce site: face masks||330|
|Corona Virus Masks – Corona Virus Masks||eCommerce site: face masks (partially-constructed)||300|
|Coronavirus COVID-19 Masks for Sale and Masks In Stock 3M N95||eCommerce site: face masks||300|
|CoronaVirusFacemask||eCommerce site: face masks||240|
|Coronavirus Mask Source: In stock N95 Masks||eCommerce site: face masks||180|