Friday, 25 April 2025

Might it be possible to construct a quantitative framework for specifying and comparing sound marks?

Abstract

This paper follows on from previous work regarding algorithms for measuring the similarity of marks (focusing on the cases of colour and word marks which are amenable to exact definition and thereby lend themselves to objective quantitative comparison). This follow-up considers the case of sound marks (and other melodic sequences), which could also benefit from a more objective framework, to potentially augment or replace the existing scenario in which comparisons are primarily made on the basis of the subjective opinions of expert musicologists. A quantitative framework of this type has potential applications in the comparison of sound marks, and in the measurement of similarity between musical compositions, as is relevant to copyright disputes.

The proposed framework is directly applicable to melodies which are representable as sheet-music snippets, and comprises an 'encoding' of the melody as a string of text characters (representing both the relative pitches and relative lengths of the notes), together with the use of an algorithm previously proposed for use in word-mark comparisons (in this case, a library algorithm based on the concept of Levenshtein distance), to quantify the degree of similarity between the textual representations. The paper is illustrated using case studies, showing how the framework can be applied to produce quantitative measurements of the degree of similarity between two melodic lines. 

A similar approach could potentially also be used for analysis of more complex musical elements, or in the comparison of chord progressions. Additionally, the specific configuration of the framework could be modified, based on the exact musical features requiring analysis. The option for applying 'correction factors', to take account of the commonness of use of musical sequences, to 'offset' the measured similarity, is also considered. 

There is also potential for additional future development of the framework, potentially encompassing more complex melodic comparison concepts (such as the use of contour- or shape-similarity measurement ideas, or the analysis of N-grams - short combinations of notes comprising the basic 'building blocks' of more complex melodic lines, in some ways analogous to the concept of 'tokens' in word-mark analysis). 

Going forward, as the representation of sound marks is likely to move more toward the use of digital files such as MP3s, it is likely that the use of other concepts, such as the use of file 'hashes', may also need to be explored.

Introduction

In my previous work on mark similarity measurement[1,2], I considered the case of colour and word marks which - as features amenable to exact definition (up to a point) - potentially lend themselves to a(n at least partial) objective framework for quantitative comparison.

The world of sound marks adds an additional level of complexity but, as they can (generally, at least in part) also be specified precisely, is one where similar ideas may be applicable. This approach might be preferable to the current scenario, where musical comparisons are often based just on the (still subjective) opinion of an expert musicologist - an option which is still used because there is no widely accepted alternative objective framework and, in many disputes, no such exact specifications of the marks in question have been requested.

In this initial exploration, I consider the most basic case of a simple melody (such as a jingle or distinctive musical motif) which can be written as a sheet-music snippet, although some of the ideas might be generalisable to more complex cases, such as music which is representable as more detailed (e.g. orchestral) written scores, or even to any arbitrary sound which can be represented as a digitised waveform (which, in essence, can be expressed simply a sequential set of discrete values) – noting that more complex marks are increasingly becoming registrable, following the relaxation of the requirement for trademarks to be representable in a graphical form (under e.g. EU Directive 2015/2436[3]).

The ideas are also applicable to assessments of similarity between longer compositions, as would be likely to be more relevant to copyright (rather than trademark) disputes. It is also worth noting that the legal test for copyright infringement (namely, substantial similarity, or whether all or a substantial part of the copyrighted work has been copied) is perhaps actually even more amenable to quantitative analysis than is an assessment of trademark infringement, in which the perception of the average consumer must be borne in mind, and ideas such as the doctrine of imperfect recollection[4] and cultural associations come into play.

Additionally, it is worth noting that the proposed framework is generally consistent with established principles regarding the nature, comparison and infringement of sound marks. A summary of many of the relevant ideas is provided by Geiregat (2022)[5], with significant points including the facts that: (i) in the EU, sound marks may be represented by digital audio files or by graphical representation in musical score notation, to represent the pitch and duration (as the most significant characteristics) of the sounds; (ii) sound marks must be distinctive indicators of commercial origin, rather than being exclusively functional, also implying that they cannot be too short ('banal') or too long ('complex', and therefore not easily memorable); and (iii) comparison between sound marks will often consider aural similarity as the decisive factor, and instrumentation and tempo will generally be of secondary importance in this assessment. Similar remarks can be taken directly from the EUIPO's 2021 published guidance on common practice regarding new types of marks[6], which explicitly states that the melodic element of a sound mark "has a considerable impact on the way the mark is perceived … and therefore … [on] the aural comparison of such a mark". Other elements, including instrumentation, tempo, intonation, voice, etc. are stated as having a lower impact. 

(Musical) steps towards a possible definition framework

Formulation

For a basic musical melody, I assert that the two primary features which make the tune recognisable are the relative pitches and relative lengths of the notes. The absolute pitch is probably less important (since a piece of music when transposed, or a key-change applied, is still recognisable as the same piece[7]  - e.g. the snippets shown in Figure 1 (even ignoring the associated chord symbols) are both clearly the first line of 'Happy Birthday'), as is the speed of the meter (such that additionally, for example, a melody could be written with all note-values halved, or doubled, without materially changing the melody). The proposed framework for representing a musical snippet therefore focuses on these first two features referenced above.

Figure 1: The first line of 'Happy Birthday' in D major (top) and E major (bottom) (courtesy of PatternPiano[8])

For pitch, I propose expressing all intervals in terms of the number of semitones, which will allow us to specify any possible note (at least, in standard Western music). This is likely preferable to the classic musical terminology notation of 'firsts', 'seconds', 'thirds', etc., which do not cover notes outside the basic major scale (e.g. 'minor thirds', 'augmented fourths', etc.).

The significance of an absolute difference between two notes, expressed as a number of semitones, will, however, depend on the context (i.e. the key signature). For example, a difference of one semitone can be the difference between a note in the basic major scale and one which is not (e.g. C and C♯ in the scale of C major) or the difference between two notes in the scale (e.g. between E and F). I therefore propose a framework where each note is assigned a value equal to the number of semitones above the note at the 'base' of the scale (i.e. the  'root' or 'key' note) - actually, one more than this value, since the base note is assigned a value of 1. (For shorter musical snippets, or ones where the key signature is unclear or undefined, it might be appropriate just to set this base pitch as that of the first note of the snippet.*)

Accordingly, therefore, the thirteen distinct semitones in a chromatic scale starting at C would be assigned the values shown in the middle row of Table 1. (N.B. The notation is similar to that used in hexadecimal, etc., where letters are used after the value '9', such that the pitch of each note can be represented just as a single character - though I propose the use of lower-case letters to avoid confusion with note names). 

Table 1: Semitone-based notation for the notes in a chromatic scale, relative to the base / root note (in this case, C)

For note lengths, one simple option would be to consider each note as a multiple of the shortest note used in the overall representation, and represent it by repeating its pitch symbol a number of times equal to that multiple. For example, in a musical snippet consisting of a mixture of quavers (♪) (half a beat; sometimes called 'eighth notes') and crotchets (♩) (a full beat; 'quarter notes'), the quavers would be written as one repeat of the appropriate pitch symbol, and the crotchets - twice the length - as two repeats. Finally, distinct notes can be denoted using a separator (say, '-'), and rests by a zero ('0'). 

It is worth noting that this framework will not cover all elements of a written melody (such as time signature / position of bar lines), and will also not take account of features such as the nature of any associated instrumentation, playing techniques, or underlying chord progressions, but should capture the primary elements which make the melody recognisable. The characteristics which are unrepresented in this simple framework will, of course, all contribute to the 'overall impression' of a musical piece, and (at least in a trademark sense) probably would be relevant in any fully rigorous overall determination of likelihood of confusion (though, as per the comments in the introduction, can probably reasonably be considered to be of secondary importance). 

How would the suggested construction look in practice? The simplest case of a basic major scale of notes of equal length (Figure 2) would be expressed as 1-3-5-6-8-a-c-d.

Figure 2: A scale in C major (image courtesy of Playground Sessions[9])

* The point mentioned above might be applicable to a musical motif such as the small set of alternating notes, separated by a semitone, at the start of the Jaws theme (Figure 3), which arguably is distinctive even in isolation (and would be represented, taking E as the 'base' note, and taking the quaver as the basic 'unit' of note length, as 11-2-00000-11-22-1-000). 

Figure 3: The distinctive motif of the Jaws theme (image courtesy of Musescore[10])

By adopting this approach - essentially, allowing us to represent a musical snippet as a text string analogous to a word mark - there is the potential for a framework for specifying the snippet as a convenient, character-based format and for comparing snippets against each other using some of the word-similarity metrics defined in the previous studies. There is therefore the possibility either for quantifiably specifying how similar two complete musical motifs are to each other, or to identify the length of common elements between two longer tunes (essentially, by looking for the longest common substring[11] between the two). This might have applications in, say, copyright disputes.

Furthermore, the character-based representations of the musical snippets and/or the similarity metrics themselves could be modified, to adjust exactly which aspects of the compared snippets are being considered (or disregarded). For example, it might be appropriate to disregard the separators between the notes (so that, for example, a pair of quavers on the same note would be considered to be identical a crotchet of that note - if we wanted to assume that these two were essentially interchangeable from the point of view of musical distinctiveness. 

Another option might be to modify the similarity metric so that the 'score' assigned to the similarity between two snippets would be modified according to the size of the difference in pitch between differing notes (rather than just considering whether a note is different or not). For example, we might want to consider that the difference between a C and a D is 'numerically' smaller than the difference between a C and a G, or that notes which are more harmonically similar (e.g. a C with an E (a perfect third) or a G (a perfect fifth)) should be 'scored' as less distinct than notes which are more harmonically dissimilar (e.g. a C with a D♯ or an F♯).

There may also be cases where other modifications to the framework may be appropriate, such as assuming notes separated by an octave to be 'the same' (i.e. having just 12 basic distinct pitches - '1' to 'c' - and then repeating the symbols for subsequent octaves).

Illustrations and case studies

"Plim"

One frequently-cited legal case concerns a short sound mark represented using musical notation (Figure 4). 

Figure 4: The graphical representation of the Plim sound mark, as presented in its application

There is a detailed case history regarding the attempted registration of this particular mark, initially rejected by the examiner, a decision which was ultimately maintained following appeal - with additional complexity resulting from the fact that the mark itself includes a textual element ("PLIM PLIM" - i.e. 'ring, ring'), but it has generated some accepted case law. This includes the (paraphrased) statements that the criteria for assessing the distinctive character of sound marks are no different from those applicable to other categories of trademark (Para 41) and that it is common for a consumer to be able to identify a specific product or service as a result of a sound element (Para 43)[12]. Furthermore, the test for whether a mark is devoid of distinctive character should be no stricter for sound marks than for other marks, and the simplicity alone of a musical element does not in itself imply a lack of distinctive character. 

Regardless of the specifics of this particular case, (the melodic component of) this mark does make it amenable to representation using the proposed framework (as the very simple string 5-5555555 - or, arguably, as 1-1111111, since the key is essentially arbitrary), which could allow it to be quantifiably compared against other marks.

The James Bond theme

The James Bond theme - one which is highly familiar to generations of movie-goers, and distinctive to the franchise - has a somewhat complex history from an intellectual property point of view. A 25-second segment of the introduction to an orchestrated version of the theme was finally successfully registered as a sound mark[13] by brand owners Danjaq LLC in 2021[14], following an earlier refusal on grounds including the length of the segment. One of the central points of the complexity is the distinction between short musical snippets (such as jingles), which can have clear brand associations and can potentially serve as a mark, and longer pieces of music (which are more usually protected by copyright). 

Is there perhaps a case to be made that a more appropriate sound mark for James Bond would have been just the musical motif shown in Figure 5 (the initial guitar solo in the full orchestrated version), which is arguably distinctive as an 'indicator of origin' in its own right? This snippet would be 'encoded' (noting that the key is E minor, and taking the semiquaver as the base unit of length) as 11-3-3-33-3333-11-11-11-11-4-4-44-4444-33-33-33.

Figure 5: The distinctive motif of the James Bond theme (image courtesy of 007museum.com[15])

Amazing vs Photograph

The (purported) similarity between sections of these two songs was the subject of a copyright dispute in 2017, in which the writers of the former - released as a single by Matt Cardle in 2012 - sued Ed Sheeran, the writer of the latter, in a case which was ultimately settled out of court by Sheeran. The writers of Amazing claimed the chorus of the songs had 39 identical notes in common, with similarities "instantly recognisable to the ordinary observer", submitting court documents highlighting the similarities in chord progression and melody (Figure 6)[16,17]

Figure 6: A comparison of the similar sections of Amazing and Photograph, taken from court submissions (image courtesy of BBC[18])

In the context of this paper, the case is interesting because it can be used to illustrate how the use of the textual representations of the two melodies, derived from the side-by-side standard musical notations shown in Figure 5 (though not considering the chord progressions for now), can be used to quantify the degree of similarity between the two.

Considering the similar portions from bar 1 to the first beat of bar 7, and comparing the second of the two versions of the Amazing melody with Photograph (plus also making a couple of other simplifications[19]), the two snippets can be written as:

Amazing (v2):

  • 1-3-1-555-00-11-00-3-5-1-66-5-3-1-55-00-33-00-3-5-1-66-5-3-1-55-00-11-00-3-5-1-66-5-3-3-11

Photograph:

  • 0-1-1-3-55-00-8'8'-00-3-5-5-66-5-3-1-55-00-33-00-5-5-5-66-5-3-1-55-00-33-00-3-5-0-66-5-3-111

N.B. ' 8' ' is actually ' 8 ' transposed down by an octave

By any measure, these can be seen to be extremely similar, differing only in the characters highlighted in bold / underlined (equivalent to the unhighlighted notes in Figure 4). However, the key point - and the one of relevance for application in copyright and/or mark disputes - is in quantifying how similar. Any appropriate metric will probably need to include some element of 'normalisation' relative to the overall length of the snippet / string (e.g. two passages of 40 notes differing by only 5 notes should reasonably be considered to be more similar than two passages of 10 notes differing by 5), and it may also be appropriate in future modifications of the methodology to consider the length of the similar sections relative to the lengths of the songs as a whole

In this case of the two textual representations shown above, the strings differ by only 12 characters out of the total of 54 (i.e. 78% similar) (ignoring the '-' separators for now). However, the use of one of the similarity metrics discussed in the previous work on word-mark comparisons may yield a more robust approach (because of the greater flexibility in considering different aspects of the similarities and differences between the strings). Using the fuzz.ratio metric, for example - an algorithm based on the concept of Levenshtein distance, and which also incorporates an element of normalisation relative to the length of the strings[20,21,22] (rather than the full similarity score formulation previously proposed for word marks, which - through the use of the Jaro-Winkler similarity metric - includes consideration of the proximity of the matching characters to the start of the string, and which may not be appropriate where considering musical passages), we find that the strings are measured as being 86% similar.

Comparison with previous research on melodic comparison

Outside the various machine-learning and AI-based approaches which have been explored by researchers in attempting to measure the degree of similarity between different musical compositions and genres, a number of other algorithmic approaches have also been proposed - which are generally more deterministic, and potentially better suited to the type of quantitative repeatable frameworks most suitable to melodic comparisons in a legal / IP context (i.e. for addressing sound-mark or copyright disputes). Some of these previous ideas share significant parallels with the framework proposed in this paper, indicating that the approach is broadly potentially robust, but with the research also providing a number of potential routes for expanding the methodology.

One of the strongest parallels appears in the overview provided by Gurjar & Moon (2018)[23], who explicitly reference the option to represent a (monophonic) musical piece as a one-dimensional string of characters and then use an edit-distance algorithm (such as Levenshtein) to compare strings against each other. Their summary suggests that, in many such implementations, the duration of notes is generally not considered, but the framework presented in this paper does address this point (through the use of the number of character repeats to denote note length). An overview of other approaches which take account of these and other musical features is provided by Cahill (2008)[24]

Other common possible approaches include implementations of contour- or shape similarity measurement (essentially, representing melodies geometrically (e.g. using curve- ('spline') fitting) and then comparing the shapes of the geometric representations - in some cases, also using similar edit-based algorithms) (e.g. da Silva Sampaio, 2018[25], Urbano et al., 2011[26], Hu et al., 2002[27]), and/or N-gram analysis (i.e. representing melodies as combinations of short distinctive elements).

Discussion

The landscape of copyright disputes in popular music is an extensive one, including a number of other high-profile cases in recent years[28]. One such example is another (2023) case involving Ed Sheeran, who was ultimately found not to have copied the Marvin Gaye hit Let’s Get It On when writing Thinking Out Loud, as had been asserted. The case primarily surrounded the use of a shared similar pattern of syncopated chords between the two songs, though the claim was ultimately accepted that these are simply "commonplace musical building blocks"[29,30,31,32]. However, the history of similar cases has proved somewhat inconsistent, with (for example) Blurred Lines found to have infringed Gaye's Got to Give It Up in 2015, but Led Zeppelin winning an appeal regarding Stairway to Heaven (re Taurus) in 2020 - a case which provided guidance on the preferred handling of other future cases, and which was followed in one concerning Katy Perry's Dark Horse[33].

The Thinking Out Loud case also highlighted the commonalities and similarities (particularly in terms of features such as chord progressions) shared by large numbers of distinct songs in many cases[34,35]. It is also clear that inspiration by previous work is a significant component of songwriting[36], and an over-overly enthusiastic approach to protection could stifle creativity[37]. The point was also picked up by veteran songwriter Burt Bacharach, though with the suggestion that the issue could be addressed through the use of a panel of music experts to decide on copyright issues[38].

As alluded-to at the outset of this article, much of the discussion of the case has indeed focused on musicological analysis[39,40,41], but it seems reasonable that the additional application of some sort of quantitative approach in such cases could yield some useful insights. Chord progressions could potentially be represented within a similar framework to that proposed in this article for melodic lines, meaning that an analogous approach to their comparison could be applied. However, it would probably be appropriate to include a 'normalisation' (or 'correction factor') to the calculated degree of similarity between two sequences, based on how common they are generally in the 'corpus' of recorded songs (i.e. the shared use of a chord progression which is very common would be less likely to imply a creative link than for a much more unusual chord sequence). Common sequences - which have been used extensively in a wide range of songs - would include examples such as  I–V–vi–IV[42] (or, in the key of D, D-A-Bm-G) (the 'Axis of Awesome' progression)[43,44], or I-V-vi-iii-IV-I-IV-V (in D: D-A-Bm-F♯m-G-D-G-A) (the sequence derived from Pachelbel's Canon)[45,46,47]. At the other end of the spectrum would be something like the sequence from the Beach Boys' God Only Knows, an innovative and fairly unique chord progression (D/A-Bm-F♯m-F♯m/A-E/B-Cdim- E/B- A♯ΓΈ) which is so 'non-standard' that it is not even clear which key the song is written in[48,49]. It may be the case that similar comments are true for the comparison of melodies or melodic 'snippets', rather than just for chord progressions.

Returning to the main focus of the article, despite its possible application in an assessment of similarity between sections of melody in copyright disputes, the proposed framework is primarily intended for use in the quantitative comparison of shorter musical motifs which may serve as (sound) marks - potentially as part of any dispute analysis process. It is worth pointing out again that this type of textual representation really adds benefit only for this type of quantitative comparison analysis, given that the representation of marks is better served by the use of traditional notation (i.e. sheet music), or (now) digital files such as MP3s. Going forward, these types of digital representations of sound marks may also lend themselves to more of a quantitative comparison approach, through the creation of 'hashes' (i.e. a digital 'fingerprint' or 'summary') of the file, which can be compared against each other, and are already utilised in areas such as the identification of copied digital imagery.  

Acknowledgements

This article was inspired by a discussion at the Stobbs training session 'A run-through of important UKTM and EUTM decisions from the last 6 months' by Geoff Weller (Cambridge, 13-Mar-2025) - with thanks to Geoff Weller, Jack Wing and David Llewellyn for their significant input and subsequent discussions.

References

[1] https://www.linkedin.com/pulse/measuring-similarity-marks-overview-suggested-ideas-david-barnett-zo7fe/

[2] 'Towards a new paradigm for objectively measuring the quantitative similarity of marks - Colour and word marks' [summary paper; not yet published]

[3] https://eur-lex.europa.eu/eli/dir/2015/2436/oj/eng

[4] https://guidelines.euipo.europa.eu/1922895/1924826/trade-mark-guidelines/3-imperfect-recollection

[5] Geiregat, S. (2022). Trade Marks in Sounds and Gestures: A Critical Analysis of Two Non-Traditional Signs in the EU. GRUR International, 71 (8), pp. 702–718. (Available at: https://academic.oup.com/grurint/article/71/8/702/6645926

[6] https://www.ipoi.gov.ie/en/law-practice/legislation/trade-marks/trade-marks-practice-and-procedures/common-communication-on-new-types-of-marks.pdf

[7] Note that a 'key-change' in this context refers to one in which all notes in the scale are transposed equally; this is distinct from (say) a change from a major to a minor key, in which the intervals between the respective notes in the scale will be different, and which would be reflected by a distinct representation within the proposed framework.

[8] https://www.youtube.com/watch?v=MfBRW6qmMKc

[9] https://blog.playgroundsessions.com/how-to-play-any-major-scale-on-the-piano/

[10] https://musescore.com/user/282671/scores/1030571

[11] https://circleid.com/pdf/similarity_measurement_of_marks_part_3.pdf - 'Part 2 - Subsequences and substrings'

[12] https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:62015TJ0408

[13] https://euipo.europa.eu/eSearch/#details/trademarks/018168977 - includes a downloadable version of the sound mark

[14] https://euipo.europa.eu/copla/trademark/data/018168977/download/CLW/APL/2021/EN/20210312_R1996_2020-5.pdf

[15] https://www.007museum.com/James_Bond_dr_no.pdf

[16] https://www.bbc.co.uk/news/entertainment-arts-39556351

[17] https://www.theguardian.com/music/2017/apr/11/ed-sheeran-20m-dollar-copyright-claim-matt-cardle-x-factor - This article also includes links to YouTube videos of the two songs in question, with the relevant sections found at 2:26 (Photograph) and 1:46 (Amazing)

[18] https://www.bbc.co.uk/news/entertainment-arts-39556351

[19] The additional simplifications are: (i) ignoring the grace note in bar 5 of Amazing; and (ii) neglecting the trailing semiquaver in the last beat of bar 6 of Photograph, so as to allow the use of the quaver as the basic unit of length and thereby halve the overall length of the textual representation.

[20] https://pypi.org/project/fuzzywuzzy/

[21] Π’. И. Π›Π΅Π²Π΅Π½ΡˆΡ‚Π΅ΠΉΠ½ (1965). Π”Π²ΠΎΠΈΡ‡Π½Ρ‹Π΅ ΠΊΠΎΠ΄Ρ‹ с исправлСниСм Π²Ρ‹ΠΏΠ°Π΄Π΅Π½ΠΈΠΉ, вставок ΠΈ Π·Π°ΠΌΠ΅Ρ‰Π΅Π½ΠΈΠΉ символов [Binary codes capable of correcting deletions, insertions, and reversals]. Π”ΠΎΠΊΠ»Π°Π΄Ρ‹ АкадСмии Наук Π‘Π‘Π‘Π  (in Russian), 163 (4): pp. 845–848. Appeared in English as: Levenshtein, V.I. (1966). Binary codes capable of correcting deletions, insertions, and reversals. Soviet Physics Doklady, 10 (8): pp. 707–710. (https://ui.adsabs.harvard.edu/abs/1966SPhD...10..707L/

[22] This is the same approach as was used to compare the phonetic representations of word marks, when assessing (just) their aural similarity.

[23] Gurjar, K. and Y.-S. Moon (2018). A Comparative Analysis of Music Similarity Measures in Music Information Retrieval Systems. J Inf Process Syst, 14 (1), pp. 32–55.(Available at: https://s3.ap-northeast-2.amazonaws.com/journal-home/journal/jips/fullText/64/jips_527.pdf

[24] Cahill, M. (2008). Melodic Similarity Algorithms for Scores - A Comparative Evaluation of Contrasting Approaches. PhD thesis, University of Limerick. (Available at: https://researchrepository.ul.ie/articles/thesis/Melodic_similarity_algorithms_for_scores_a_comparative_evaluation_of_contrasting_approaches/19811551?file=35260366

[25] da Silva Sampaio, M. (2018). Contour Similarity Algorithms. J. MusMat, 2 (2), pp. 58–78. (Available at: https://musmat.org/wp-content/uploads/2018/12/08-contour-similarity-algorithm.pdf

[26] Urbano, J., J. LlorΓ©ns,, J. Morato and S. SΓ‘nchez-Cuadrado (2011). Melodic Similarity through Shape Similarity. CMMR 2010, LNCS 6684, pp. 338–355. (Available at: https://julian-urbano.info/files/publications/019-melodic-similarity-through-shape-similarity.pdf

[27] Hu, N., R.B. Dannenberg and A.L. Lewis (2002). A Probabilistic Model of Melodic Similarity. In: Proceedings of the International Computer Music Conference (San Francisco, International Computer Music Association). (Available at: https://www.cs.cmu.edu/~rbd/papers/icmc02melodicsimilarity.pdf

[28] https://www.nytimes.com/2023/04/27/arts/music/music-copyright-lawsuits-ed-sheeran-blurred-lines.html

[29] https://www.bbc.co.uk/news/av/world-us-canada-65420696

[30] https://www.rollingstone.com/music/music-news/ed-sheeran-wins-marvin-gaye-copyright-lawsuit-appeals-1235150674/

[31] https://trademarklawyermagazine.com/from-love-song-to-lawsuit-ed-sheerans-copyright-win-over-marvin-gayes-lets-get-it-on/

[32] https://www.brunel.ac.uk/news-and-events/news/articles/Whats-going-on-Ed-Sheerans-Marvin-Gaye-copyright-case

[33] https://www.nytimes.com/2023/05/04/arts/music/ed-sheeran-marvin-gaye-copyright-trial-verdict.html

[34] https://www.newyorker.com/magazine/2023/06/05/ed-sheeran-copyright-infringement-lawsuit-marvin-gaye

[35] https://www.independent.co.uk/arts-entertainment/music/news/ed-sheeran-lawsuit-marvin-gaye-song-b2327312.html

[36] https://www.reddit.com/r/WeAreTheMusicMakers/comments/8w13rs/ed_sheeran_vs_marvin_gaye_lawsuit_lets_compare/?rdt=54653

[37] https://news.sky.com/story/ed-sheeran-beats-copyright-appeal-over-claim-thinking-out-loud-ripped-off-marvin-gayes-lets-get-it-on-13246150

[38] https://www.bbc.co.uk/news/entertainment-arts-40813002

[39] https://www.musicologize.com/thinking-out-loud-v-lets-get-it-on-lawsuit-deep-dive/

[40] https://www.musicologize.com/lets-get-it-on-vs-thinking-out-loud-infringement-or-just-similarity/

[41] http://www.popularmusicology.com/2016/08/12/musicology-thinking-loud-v-lets-get/

[42] This is using the Roman numeral analysis system for chords, where the number denotes the 'degree' (in the sale) of the chord, and the case represents the 'quality' (upper = major; lower = minor) - see e.g. https://viva.pressbooks.pub/openmusictheory/chapter/roman-numerals/

[43] https://en.wikipedia.org/wiki/The_Axis_of_Awesome

[44] https://www.woovebox.com/support/guides--tutorials/chords/popular-chords/i-v-vi-iv-axis-of-awesome/

[45] https://en.wikipedia.org/wiki/List_of_variations_on_Pachelbel%27s_Canon

[46] https://www.anneku.com/2023/06/12/pachelbel-progression/

[47] https://www.reddit.com/r/musictheory/comments/fmrzgs/songs_with_the_same_chord_progression_as/

[48] https://www.secretsofsongwriting.com/2011/10/26/classic-song-analysis-god-only-knows-wilsonasher/

[49] https://www.the-solute.com/the-luxuriant-mysteries-of-god-only-knows-year-of-the-month/

This paper was first published as an e-book on 25 April 2025 at:

https://www.iamstobbs.com/insights/world-ip-day-2025-might-it-be-possible-to-construct-a-quantitative-framework-for-specifying-and-comparing-sound-marks

Wednesday, 23 April 2025

Brand Monitoring Data-Niblet #4: DOGE/MAGA

The latest in the long line of high-profile entities finding themselves subject to impersonation for the purposes of fraud is (perhaps predictably) the US 'Department of Government Efficiency' (DOGE), often referenced in conjunction with Trump's MAGA ('Make America Great Again') tagline. 

One recent report[1,2] concerns an SMS- (text-message) based scam purporting to be offering government payouts, with the intention of actually collecting user credentials and/or donations (Figure 1). 

Figure 1: An SMS-based DOGE impersonation scam

In this case, the homepage of the 'MAGA'-specific domain name utilised in the scam actually resolves to a page stating that the site has been configured as a URL-shortening service (which not only potentially makes the scam-specific content - buried on a specific URL - harder to detect, but also provides the potential for multiple scams to be launched using the same site, and also allows the content to be hosted - via a re-direct, as used in this case - on an arbitrary separate site).

Screenshots of the destination page of the link in the SMS message are shown in Figure 2.

Figure 2: Screenshots of the destination page of the link in the SMS message shown in Figure 1

Unsurprisingly, this is far from an isolated case. There are over 38,000 gTLD domains with names beginning with 'doge' or 'maga'. With a view to identifying those most likely to be associated with the above types of scams, it is instructive to remove any obvious false positives (domains containing 'magasin*', 'magazin*', 'magazijn' or 'magazzin*', or any with names containing 'coin'; more likely to pertain to crypto-related content (or scams specifically associated with this)[3]). This still leaves over 28,000 domains - a testament to the high profile of DOGE and MAGA and the range of ways in which they are referenced online. Accordingly, it is helpful to employ an 'inclusional' filtering approach, and consider only those domains with names explicitly also containing 'gov', 'usa', 'maga(-)us' as an explicit string, 'fund', 'pay' or 'check' - leaving a dataset of 378 examples.

Of these, 259 resolve to live website content (though noting that the others may also be in active use for phishing, etc. in cases where active MX records are present) and 101 have 'non-zero' webpage titles for their homepage.

Amongst these live sites, there are a number of examples of potential concern, in addition to a range of low-threat examples currently (e.g. placeholder pages), but which have the potential to be activated in the future. 

The content of the sites cover a range of different categories, including e-commerce sites (for DOGE/MAGA-themed merchandise) (dogegovapparel[.]com, dogegov[.]store, magamanusa[.]net), informational sites (dogegovmap[.]com, dogetaxpayersavings[.]org, doge-gov[.]com, dogegov[.]com, dogegovapp[.]com, dogegovlive[.]com), instances of false affiliation or misdirection to other types of content (dogecasinousa[.]casino, dogepayments[.]tech), and yet more crypto-related material (dogegovtrx[.]vip, dogegov[.]xyz, dogegovprogram[.]com, dogeusa[.]pro, dogeusa[.]com) - however, other apparent scam sites similar to the example reported at the outset were also identified (Figure 3) - in addition to another, potentially real site (magalegaldefensefund[.]com), re-directing to a GoFundMe page soliciting for donations to fund the cases being brought by Trump against various legal entities! Furthermore, additional to magaus[.]net, three further domains (magaus[.]org, magaus[.]info and maga-us[.]com) were found to have been configured to serve as URL-shorteners and may have further active scams associated with them.

Figure 3: Other live examples of apparent DOGE-related scam websites - dogegrantfunding[.]com, dogeusataxes[.]com

References

[1] https://www.linkedin.com/posts/activity-7320163174064803840-QCeO

[2] https://www.linkedin.com/posts/ayelet-biger-levin_scamprevention-ugcPost-7320165631750770691-I0oJ

[3] https://www.iamstobbs.com/opinion/january-scams-surrounding-the-fall-and-rise-of-tiktok-and-trump

This article was first published on 23 April 2025 at:

https://www.linkedin.com/pulse/brand-monitoring-data-niblet-4-dogemaga-david-barnett-czlke/

Saturday, 19 April 2025

Brand Monitoring Data-Niblet #3: Internet Crime Complaint Center (IC3) impersonations

Or: "Quis custodiet ipsos custodes?"

In cases reminiscent of the recently-reported impersonations of the United States Patent and Trademark Office (USPTO)[1], the US Internet Crime Complaint Center (IC3) (Figure 1) - operated in partnership with the FBI - recently also warned of a spate of impersonation attacks. In many cases these utilised e-mail, telephone, or social-media-based approaches, often targeting victims of previous scams under the guise of providing assistance, support or fund recovery, with a view to 'revictimising' these individuals[2]

Figure 1: The IC3 official website, at ic3[.]gov

In this analysis, I consider the landscape of gTLD domains with names beginning 'ic3', many of which (where not used by third parties legitimately using the same abbreviation) may have significant potential for use in IC3 impersonation scams. 

As of 18-Apr-2025, there are 896 such domains. Many of these actually comprise long, apparently-random strings of 32 characters in length or greater and - whilst potentially relating to automated registrations which may be associated with infringing activity - are unlikely to be targeting the IC3 specifically. Removing these examples leaves a remaining dataset of 489 domains, of which 3 appear to be official (either ic3[.]gov itself, or domains which re-direct to it). 

Of the third-party domains, 222 resolve to some sort of live website response, and a total of 41 include some sort of high-risk keyword ('gov', 'usa', 'support', 'help', 'complain*' or 'cyber') - implying that, even if not in active use as part of a scam, they may be intended for activation for fraudulent use in the future. 

Many of these domains do appear to be associated with legitimate third-party use, but there are at least three examples resolving to live websites which appear to be exhibiting fraudulent, impersonation-based activity (or appear likely to do so in the future) (Figure 2).

Figure 2: Examples of probable IC3 impersonation websites - top to bottom: ic3[.]uno, ic3fbi[.]org, ic3govusfraudftc[.]net

Given the FBI's resources and apparent appreciation of the importance of reporting related scams of which they have been made aware, it is concerning that such a simple search is able to identify a number of examples of active websites of concern, and suggests that this type of proactive monitoring is not being actively carried out. The results once again highlight the importance of employing programmes of brand monitoring and enforcement to tackle such scams as they arise. 

References

[1] https://www.iamstobbs.com/insights/poking-the-bear-brand-impersonation-scams-targeting-intellectual-property-offices

[2] https://www.linkedin.com/feed/update/urn:li:activity:7319031085093269504/

This article was first published on 19 April 2025 at:

https://www.linkedin.com/pulse/brand-monitoring-data-niblet-3-internet-crime-center-ic3-barnett-hf1ve/

"com- away with me": Use of 'com-' domains in the construction of deceptive 'URL-like' hostnames

Introduction

A key component of many instances of brand infringement or fraud is the construction of a URL appearing deceptively similar to that of the website of the brand being impersonated. This type of deception is often key to the misdirection of customers to the fraudulent site[1].

One example of a methodology employed by infringers is the use of a non-brand-specific domain name, together with a branded (or otherwise relevant) subdomain name which, when combined, produces a hostname[2] appearing similar to the URL of an official site. This is illustrated by the example shown in Figure 1, showing an SMS- (text message) based scam targeting UK customers of a large international banking brand (referred to in the description below as 'bankbrand'), and as also discussed in previous analyses[3,4].

Figure 1: Example of a message comprising an SMS-based scam targeting UK customers of a large international banking brand, using a deceptive ('uk-') domain name / subdomain combination

This approach is attractive because it avoids the requirement to register a brand-related domain name (which can readily be picked up by a brand owner employing a domain-monitoring solution), and works on the principle that a domain owner can configure whatever subdomain-name hierarchy they wish. In the case of Figure 1, the actual registered domain name is 'uk-account[.]help' (using the new-gTLD[5] domain extension '.help', which may be unfamiliar to many users), with a subdomain name of 'bankbrand[.]co'. The technique is additionally effective because of the tendency of mobile SMS message viewers to add line breaks after a hyphen, leaving 'bankbrand[.]co[.]uk-' - superficially very similar to the bank's official domain name - on a single line.

The previous analysis of this type of scam focused on domain names beginning with 'uk-' (as in the above example); in this new study, we consider domains with names analogously beginning with 'com-', which generally have a more global relevance and applicability, particularly in view of the commonness of use of the .com extension by official brand websites. 

Analysis

The analysis, using data from domain name zone files, revealed the existence of 11,070 gTLD domains with names beginning 'com-'. Of these, 1,871 have been deemed of moderate or high additional potential concern, on the basis of the presence also in the domain name of keywords which may be associated with types of scam frequently seen (e.g. phishing or parcel-tracking scams)[6].

Of these 1,871 domain names, we first consider the existence of hostnames consisting of each of the domain names prefixed by the names of any of the top ten most highly phished brands in 2024[7], either in isolation, or themselves prefixed by 'www.' - i.e. direct checks for 2 × 18,710 'candidate' hostnames which, if active, have a significant potential for abuse. 

2,040 of these produce some sort of live website response, although none were found to resolve to active infringing content as of the time of analysis. Some examples do appear to be in use by legitimate third parties who just happen to use 'com-'-style domain names (with the fact that the brand-specific subdomains also resolve to site content perhaps just implying that the sites have been configured with wildcard DNS records, such that any arbitrary subdomain name will resolve to the site). Others appear even to have been set up as part of corporate phishing tests / cybersecurity training projects, but with many more found to resolve to placeholder pages or just currently to be inactive.

As a more robust deep-dive, we next consider the existence of arbitrary subdomains on any of the 1,239 domains featuring 'high-risk' keywords, through the use of a discovery script[8,9] (which uses a range of data-sources, including information on SSL certificates, and other databases) designed to identify those subdomains which have been explicitly configured (and, accordingly, are likely to have been intended for active use, which is highly probably fraudulent in the cases where brand references are identified). 

Through this analysis, 835 active subdomains / hostnames were identified. Again, almost none were found to resolve to active infringing content as of the time of analysis, apart from two examples impersonating news websites as part of an apparent campaign to promote an online casino website (Figure 2).

Figure 2: Examples of fake news websites promoting an online casino 

Hostnames:

    • cnn[.]com-securityguardwins[.]net
    • usatoday[.]com-securityguardwins[.]net

One further example (apple[.]com-secureweb[.]info) was found to re-direct to a URL making a specific reference to the term 'login', and which is therefore highly likely to have been associated with phishing activity, even though the site content was no longer present.

None of the remainder currently resolved to any significant content of concern, although a significant proportion generated browser warning messages warning of 'dangerous' content which was presumably formerly present. 

Also of note are the significant numbers of identified subdomains (above and beyond the handful of active examples referenced above) including brand-specific references, highly suggestive of fraudulent intent. These include:

  • For domain names containing the specific 'high-risk' keyword 'account' (59 domains):
    • 18 subdomains containing 'paypal
    • 9 containing 'apple' (or misspellings)
    • 2 containing 'youtube'
    • 2 containing 'intuit'
    • 1 containing 'facebook'
  • For domain names containing other 'high-risk' keywords (1,180 domains):
    • 313 subdomains containing 'usps'
    • 45 containing 'apple'
    • 32 containing 'xfnity' [sic]
    • 31 containing 'icloud' or 'lcloud' (with a lower-case 'L')
    • 2 each containing 'net(-)flix', 'amazn' [sic], 'postbank', and 'quickenloans'

Many of these have clear potential for deception and fraudulent use, with examples of identified configured hostnames including:

  • apple[.]com-account-alert[.]com
  • apps-paypal[.]com-account-help[.]center
  • www[.]paypal[.]com-accounts[.]com
  • paypal[.]com-myaccount[.]net
  • www[.]paypal[.]com-useraccount[.]info
  • appleid[.]apple[.]com-verificationform-accountid[.]com
  • usps[.]com-tracking[.]vip
  • netflix[.]com-appsign[.]com
  • www[.]login-xfnity[.]com-auth-id-573472314645[.]com
  • www[.]apple[.]com-id[.]app
  • www[.]mail[.]quickenloans[.]com-securemessage[.]center
  • www[.]icloud[.]com-signin[.]info

Extending this analysis out to the 632 'moderate risk' 'com-' domains, we find an additional 1,390 configured active subdomains. As previously, many of these are inactive, but even these in some cases highlight another attractive aspect of this style of scam; namely that it allows multiple brands to be targeted using a single domain name (as evidenced by the presence of groups of examples such as ww16[.]timhortons[.]com-freevouchers[.]online, ww16[.]ikea[.]com-freevouchers[.]online and ww16[.]mvideo[.]com-freevouchers[.]online). 

However, 291 of the hostnames do generate some sort of live website response. Some of these do appear to pertain to content associated with legitimate hosting services (e.g. a number of subdomains of com-online.com, which appears to be a German provider of digital media services); however, there do seem to be a number of other examples where the content appears to comprise instances of brand impersonation, as shown in Figure 3[10].

Figure 3: Examples of live site content identified on subdomains of domains featuring 'moderate risk' keywords, and which appear to constitute cases of brand impersonation

Hostnames and (in brackets) identity of apparently impersonated brand in each case (top to bottom):

    • pay[.]com-support[.]services
      • (pay[.]com)
    • hiup[.]com-official[.]asia
      • (hiup[.]com[.]vn)
    • varilin[.]com-official[.]asia
      • (Varilin - healthcare product)
    • cn[.]com-pinggu[.]online
      • (China Agricultural University - actually en[.]cau[.]edu[.]cn)
    • jordan[.]com-online[.]shop
      • (Coach - main website actually coach[.]com, not jordan[.]com)

Conclusion

The analysis highlights how these types of non-brand-specific domain names can be utilised in the construction of highly effective infringements. Whilst almost none of the hostnames resolved to live fraudulent content as of the date of analysis, the nature of many of the hostnames is highly suggestive of fraudulent intent, and it is likely that many have previously been utilised for short-lived campaigns (as seen by the browser warning pages present in many cases), or have not yet been 'weaponised' (highlighting the importance of ongoing content tracking). It is also noteworthy that the analysis will only be seeing a tiny proportion of the 'universe' of potential examples of such scams, in view of the fact that we are considering only a subset of the potentially relevant domain names (gTLD 'com-'s only), the direct checks are focusing only on a limited group of brands, the subdomain detection will not be comprehensive, we have been considering only the homepages of the sites in question, and we are browsing only from desktop devices (where some sites may be intended only to be viewable from mobile browsers, for example). 

The detection of these types of scams presents an additional level of difficulty compared with the identification of branded domain names, since they are not straightforwardly identified through standard domain-monitoring techniques. Accordingly, an awareness of this type of infringement can be extremely valuable, even if additional monitoring approaches - such as the use of passive DNS analysis and certificate transparency analysis, as well as the types of tools and databases outlined in this study, potentially also together with the use of other techniques, such as the use of spam traps and direct subdomain checks (including for misspellings) - are required to actually detect the relevant subdomains which might be associated with the types of domains relevant to this type of scam. 

The issues presented in this study are also relevant to the idea of threat quantification[11,12], where - for example - 'com-' domains (and others amenable to use in similar ways) should be considered particularly high-risk, and probably comprise an area worthy of specific monitoring, in wider holistic brand-monitoring services. 

References

[1] 'Patterns in Brand Monitoring' (D.N. Barnett, Business Expert Press, 2025), Chapter 7: 'Creation of deceptive URLs'

[2] The subdomain of a URL is the portion prior to the domain name, and separated from it by a dot ('.') (e.g. 'www' in 'www.iamstobbs.com'), and the hostname is the subdomain name and domain name combined.

[3] https://www.circleid.com/posts/20210615-phishing-scams-how-to-spot-them-and-stop-them/

[4] https://circleid.com/posts/20220504-the-world-of-the-subdomain

[5] A gTLD is a generic top-level domain (i.e. domain extension), and includes legacy examples such as .com, .net, etc., and a group of around 1,100 new extensions ('new-gTLDs') which have launched in the period since 2012.

[6] 'Moderate concern' keywords: bank, connect, extranet, help, listing, official, online, pack*, server, support, sys*, tech; 'high concern' keywords: account, auth, -id, parce*, secur*, sign, track.

[7] https://www.stationx.net/phishing-statistics/ - i.e. linkedin, dhl, google, microsoft, fedex, whatsapp, amazon, maersk, aliexpress, apple.

[8] https://github.com/aboul3la/Sublist3r

[9] https://circleid.com/posts/20240528-exploring-the-domain-of-subdomain-discovery

[10] N.B. Some additional examples were identified displaying cPanel, or cPanel Webmail or WHM log-in pages; it is unclear whether these also comprise instances of brand impersonation or whether they may be legitimate domain configuration pages.

[11] 'Patterns in Brand Monitoring' (D.N. Barnett, Business Expert Press, 2025), Chapter 5: 'Prioritization criteria for specific types of content'

[12] '"Notorious IP Addresses" and initial steps towards the formulation of an overall threat score for websites', Stobbs blog [link TBC]

This article was first published on 17 April 2025 at:

https://www.iamstobbs.com/insights/com-away-with-me-use-of-com-domains-in-the-construction-of-deceptive-url-like-hostnames

Wednesday, 16 April 2025

Brand Monitoring Data-Niblet #2: New-gTLD recruitment domains

The recruitment scam is a long-established style of attack, often involving the use of web content impersonating a trusted brand and targeting job-seekers with the aim of collecting personal credentials, soliciting advance-fees or recruiting money mules. 

An example of a recently reported case[1,2] concerned a successful UDRP dispute against one such scam domain, impersonating the Italian retail brand Esselunga, utilising a domain featuring an exact (second-level name) match to the targeted brand, with a new-gTLD extension (.cyou) (Figure 1).

Figure 1: Cached view of the fake site at esselunga[.]cyou (courtesy of archive.org[3]) (top) and the official site at esselunga[.]it (bottom)

The use of a new-gTLD extension is noteworthy, as many of these extensions have extensively been reported as being disproportionately associated with high rates of infringements and abuse. This popularity with bad actors arises for a range of reasons, including registration cost, requirements, and permitted use-cases, the existence and nature of IP protection programmes, and the ease of enforcement[4,5,6,7]. Other recent studies have found similar conclusions, including reports highlighting the use of extensions such as .shop, .top, .xyz[8], .buzz[9], .zip, .mov and .sbs[10]. Additionally - through the use of a domain name featuring an exact match to the name of the targeted brand - this case highlights the importance of proactive brand protection, including (potentially) the use of domain registration blocking mechanisms and defensive registrations.

In this study, I consider the prevalence of domain names containing explicit keywords ('job', 'recruit', 'apply' or 'applica*' (for 'application', 'applicant', etc.)) likely to be associated with recruitment-related content, across the largest new-gTLDs (actually those where the raw zone data-files are larger than 15 Mb in size - this covers 55 extensions in total, including several which may be particularly amenable to recruitment scams, such as .agency, .click, .digital, .group, .link, .network, .online, .page, .pro, .website, .work and .world).

In total, there are over 221,000 such domains - potentially encompassing a range of both legitimate and non-legitimate content. Looking firstly at the subset which also contain the names of any of the top ten global brands[11] yields a dataset of 111 candidate domains which may be associated with recruitment scams targeting any of these brands, of which no more than a handful appear to be under the control of the official brand owner in question. 56 of these have active MX (mail exchange) records, indicating that they have been configured to be able to send and receive e-mails and, even in the absence of any active website, could potentially be being actively used for scam activity. 

As of the date of analysis, four were found to resolve to live websites of potential concern (Figure 2).

Figure 2: Examples of live websites which could potentially be associated with recruitment scam activity targeting any of the top ten global brands (domain names: amazonjob[.]vip; amazonremotejobs[.]live; amazonjobs[.]live; applejobs[.]online)

Returning to the full wider dataset, the analysis shows that there are five extensions (.bond, .today, .click, .online and .xyz) which each have over 10,000 recruitment-related domain names registered. The domains are dominated by examples containing the keyword 'job' (207,109 out of the total of 221,297) (Figure 3).

Figure 3: Numbers of recruitment-related domains by new-gTLD and by keyword

Amongst the other obvious patterns within the dataset is a prevalence of domains featuring hyphen-separated keywords and apparently-random numerical strings, which may be indicators of the use of large numbers of automated registrations used for short periods of time as parts of large coordinated campaigns. Within the dataset, 164,784 domains (out of 221,297) feature at least one hyphen, with 67,533 featuring three hyphens or more (up to a maximum of 11). 137,015 of the domains include at least one numerical digit, with a peak in numbers occurring for domains containing five digits (74,223 instances) (Figure 4).

Figure 4: Numbers of recruitment-related domains with names containing specified numbers of numerical digits

The set of domains containing five digits is dominated by the use of the .bond extension (69,444 examples), with the bulk of these also containing two (51,427) or three (17,486) hyphens. Within this subset, several groups of what appear very likely to be batches of associated registrations were identified, including numerous examples of the form [industry]-jobs-XXXXX[.]bond, job-interviews-XXXXX[.]bond, job-offer-XXXXX[.]bond and job-placement-XXXXX[.]bond. In total, there are (for example) 7,929 distinct registered domains with names of the (highly potentially relevant) form job-offer-XXXXX[.]bond. Based on inspection of a sample of these, the majority appear to resolve just to parking pages featuring pay-per-click links, but the patterns are highly suggestive of large-scale scam activity with the associated domains being monetised through affiliate revenue in the period prior to (or after) 'weaponisation' for active use. The name format is also extremely similar to that known to have been used in prior malicious campaigns, such as one used for the distribution of information-stealing malware[12], and other studies have also flagged up .bond specifically as a high-risk TLD[13,14,15] which also has obvious specific potential for use with financial bond scams[16].

References

[1] https://www.linkedin.com/posts/ivett-paulovics_udrp-domainnames-udrp-activity-7317599963763335171-B0Ph

[2] https://udrp.adr.eu/decisions/detail?id=67dbe4de4c85a91b5a04f5b6

[3] https://web.archive.org/web/20250107140746/https://www.esselunga.cyou/

[4] https://circleid.com/posts/towards-a-generalised-threat-scoring-framework-for-prioritising-results-from-brand-monitoring-programmes

[5] 'Patterns in Brand Monitoring' (D.N. Barnett, Business Expert Press, 2025), Chapter 5: 'Prioritisation criteria for specific types of content'

[6] https://circleid.com/posts/20230117-the-highest-threat-tlds-part-2

[7] 'An updated view of bad TLDs', Stobbs blog [link TBC]

[8] https://krebsonsecurity.com/2024/12/why-phishers-love-new-tlds-like-shop-top-and-xyz/

[9] https://socradar.io/top-10-tlds-threat-actors-use-for-phishing/

[10] https://www.duocircle.com/email-security/prime-tlds-targeted-by-cyber-attackers-in-2024-roundup

[11] https://interbrand.com/best-brands/

[12] https://circleid.com/posts/20240723-an-unnatural-dot-bond-a-study-of-a-megacluster-of-malware-domains

[13] https://snapshot.internetx.com/en/domain-abuse-tlds-misused/

[14] https://interisle.net/insights/phishing-landscape-2024-an-annual-study-of-the-scope-and-distribution-of-phishing

[15] https://www.iamstobbs.com/insights/phishing-trends-2024-and-a-look-at-some-new-data-for-domain-threat-quantification

[16] https://www.fca.org.uk/consumers/share-bond-and-boiler-room-scams

This article was first published on 16 April 2025 at:

https://www.linkedin.com/pulse/brand-monitoring-data-niblet-2-new-gtld-recruitment-domains-barnett-m5zce/

The new new-gTLDs - Part 2: A wider domain of language support

As the build-up to the second round of the new-gTLD programme [1] continues towards its launch in April 2026, we take a look at the issue o...