Dial One for Scam: A Large-Scale Analysis of Technical Support Scams

Miramirkhani, Najmeh; Starov, Oleksii; Nikiforakis, Nick

doi:10.14722/ndss.2017.23163

Cited by 57 publications

(70 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The labeling was performed by the authors where each one chose among the following labels: social engineering (surveys, scams such as tech support scam [62], malicious downloads), trademark abuse (websites capitalizing on the brand of the squatted trademarks), unrelated (seemingly benign and unrelated websites), and error/under construction. Finally, the resulting labels are then used to label the entire clusters in which each sampled screenshot belongs.…”

Section: Exploring and Labeling Combosquatting Domainsmentioning

confidence: 99%

Hiding in Plain Sight

Kintis

Miramirkhani

Lever

et al. 2017

Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security

Self Cite

View full text Add to dashboard Cite

Domain squatting is a common adversarial practice where attackers register domain names that are purposefully similar to popular domains. In this work, we study a specific type of domain squatting called "combosquatting, " in which attackers register domains that combine a popular trademark with one or more phrases (e.g., betterfacebook[.]com, youtube-live[.]com). We perform the first largescale, empirical study of combosquatting by analyzing more than 468 billion DNS records-collected from passive and active DNS data sources over almost six years. We find that almost 60% of abusive combosquatting domains live for more than 1,000 days, and even worse, we observe increased activity associated with combosquatting year over year. Moreover, we show that combosquatting is used to perform a spectrum of different types of abuse including phishing, social engineering, affiliate abuse, trademark abuse, and even advanced persistent threats. Our results suggest that combosquatting is a real problem that requires increased scrutiny by the security community.

show abstract

Section: Exploring and Labeling Combosquatting Domainsmentioning

confidence: 99%

Hiding in Plain Sight

Kintis

Miramirkhani

Lever

et al. 2017

Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security

Self Cite

View full text Add to dashboard Cite

show abstract

“…Pop-up scam has not been researched in much detail yet. Miramirkhani et al [13] performed a large-scale analysis of one particular type of pop-up scams, namely technical support scams. Their methodology included a check for JavaScript alert boxes.…”

Section: Related Workmentioning

confidence: 99%

Typosquatting for Fun and Profit: Cross-Country Analysis of Pop-Up Scam

Dam

Klausner

Schrittwieser

2020

JCSANDM

View full text Add to dashboard Cite

Today, many different types of scams can be found on the internet. Online criminals are always finding new creative ways to trick internet users, be it in the form of lottery scams, downloading scam apps for smartphones or fake gambling websites. This paper presents a large-scale study on one particular delivery method of online scam: pop-up scam on typosquatting domains. Typosquatting describes the concept of registering domains which are very similar to existing ones while deliberately containing common typing errors; these domains are then used to trick online users while under the belief of browsing the intended website. Pop-up scam uses JavaScript alert boxes to present a message which attracts the user's attention very effectively, as they are a blocking user interface element.Our study among typosquatting domains derived from the Majestic Million list utilising an Austrian IP address revealed on 1 219 distinct typosquatting URLs a total of 2 577 pop-up messages, out of which 1 538 were malicious. Approximately a third of those distinct URLs (403) were targeted and displayed pop-up messages to one specific HTTP user agent only. Based on our scans, we present an in-depth analysis as well as a detailed classification of different targeting parameters (user agent and language) which triggered varying kinds of pop-up scams. Furthermore, we expound the differences of current pop-up scam characteristics in comparison with a previous scan performed in late 2018 and examine the use of IDN homograph attacks as well as the application of message localisation using additional scans with IP addresses from the United States and Japan.

show abstract

“…The incoming calls to these phone numbers are treated as malicious calls and analyzed. For more targeted scam calls, such as technical support scams, existing work [22] does a systematic study of both the scams and the call centers behind them. These works typically require recording and analyzing the voice content of the incoming calls, which may break user privacy.…”

Section: B Telephony Malicious Call Analysismentioning

confidence: 99%

A Machine Learning Approach to Prevent Malicious Calls over Telephony Networks

Liu

et al. 2018

2018 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

Malicious calls, i.e., telephony spams and scams, have been a long-standing challenging issue that causes billions of dollars of annual financial loss worldwide. This work presents the first machine learning-based solution without relying on any particular assumptions on the underlying telephony network infrastructures.The main challenge of this decade-long problem is that it is unclear how to construct effective features without the access to the telephony networks' infrastructures. We solve this problem by combining several innovations. We first develop a TouchPal user interface on top of a mobile App to allow users tagging malicious calls. This allows us to maintain a large-scale call log database. We then conduct a measurement study over three months of call logs, including 9 billion records. We design 29 features based on the results, so that machine learning algorithms can be used to predict malicious calls. We extensively evaluate different state-of-the-art machine learning approaches using the proposed features, and the results show that the best approach can reduce up to 90% unblocked malicious calls while maintaining a precision over 99.99% on the benign call traffic. The results also show the models are efficient to implement without incurring a significant latency overhead. We also conduct ablation analysis, which reveals that using 10 out of the 29 features can reach a performance comparable to using all features.

show abstract

Dial One for Scam: A Large-Scale Analysis of Technical Support Scams

Cited by 57 publications

References 19 publications

Hiding in Plain Sight

Hiding in Plain Sight

Typosquatting for Fun and Profit: Cross-Country Analysis of Pop-Up Scam

A Machine Learning Approach to Prevent Malicious Calls over Telephony Networks

Contact Info

Product

Resources

About