Dissecting One Click Frauds - Andrew.cmu.edu

Dissecting One Click Frauds∗
Nicolas Christin
Carnegie Mellon
INI/CyLab
[email protected]
Sally S. Yanagihara
Carnegie Mellon
INI/CyLab Japan
[email protected]
Keisuke Kamataki
Carnegie Mellon
LTI/CS
[email protected]
Carnegie Mellon University Technical Report CMU-CyLab-10-011
April 23, 2010
Abstract
“One Click Fraud” is an online confidence scam that has been plaguing an increasing number of
Japanese Internet users, in spite of new laws and the mobilization of police task forces. In this scam, the
victim clicks on a link presented to them, only to be informed that they just entered a binding contract and
are required to pay a registration fee for a service. Even though no money is legally owed, a large number
of users prefer to pay up, because of potential embarrassment due to the type of service “requested” (e.g.,
pornographic goods).
Using public reports of fraudulent websites as a source of data, we analyze over 2,000 reported One
Click Frauds incidents. By correlating several attributes (WHOIS data, bank accounts, phone numbers,
malware installed...), we discover that a few fraudsters are seemingly responsible for a majority of the
scams, and evidence a number of loopholes these miscreants exploit. We further show that, while some
of these sites may also be engaging in other illicit activities such as spamming, the connection between
different types of scams is much more tenuous than expected. Last, we show that the rise in the number of
these frauds is fueled by high expected monetary gains in return for very little risk. The quantitative data
obtained gives us an interesting window on the economic dynamics of some online criminal syndicates.
Keywords: Security Economics, Measurements, Web Frauds, Online Crime
∗
This research was supported in part by CyLab at Carnegie Mellon under grant DAAD19-02-1-0389 from the Army Research
Office, and by the National Science Foundation under ITR award CCF-0424422 (TRUST).
1
Introduction
In the family apartment in Tokyo, Ken is sitting at his computer, casually browsing the free section of a
mildly erotic website. Suddenly, a window pops up, telling him,
Thank you for your patronage! You successfully registered for our premium online services,
at an incredible price of 50,000 JPY.1 Please promptly send your payment by bank transfer to
ABC Ltd at Ginko Bank, Account 1234567. Questions? Please contact us at 080-1234-1234.
Your IP address is 10.1.2.3, you run Firefox 3.5 over Windows XP, and you are connecting from
Tokyo.
Failure to send your payment promptly will force us to mail you a postcard reminder to your
home address. Customers refusing to pay will be prosecuted to the fullest extent of the law.
Once again, thank you for your patronage!
A sample postcard reminder is shown on the screen, and consists of a scantily clad woman in a provocative
pose. Ken has a sudden panic attack: He is married, and, if his wife were to find out about his browsing
habits, his marriage would be in trouble, possibly ending in divorce, and public shame. In his frenzied
state of mind, Ken also fears that, if anybody at his company heard about this, he could possibly lose his
job. Obviously, those website operators know who he is and where he lives, and could make his life very
difficult. Now, 50,000 JPY (≈ USD 500) seems like a small price to pay to make all of this go away. Ken
immediately jots down the contact information, goes to the nearest bank, and acquits himself of his supposed
debt.
Ken has just been the victim of a relatively common online scam perpetrated in Japan, called “One Click
Fraud.” In this fraud, the “customer,” i.e., the victim, does not enter any legally binding agreement, and
the perpetrators only have marginal information about the client that connected to their website (IP address,
User-Agent string), which does not reveal much about the user.2 However, facing a display of authority
stressed by the language used, including the notion that they are monitored, and a sense of shame from
browsing sites with questionable contents, most victims do not realize they are part of an extortion scam.
Some victims even call up the phone numbers provided, and, in hopes of resolving the situation, disclose
private information, such as name or address, to their tormentors, which makes them even more vulnerable
to blackmail.
As a result, One Click Frauds have been very successful in Japan. Annual police reports show that the
estimated amount of monetary damages stemming from One Click Frauds and related confidence scams
are roughly 26 billion JPY per year (i.e., USD 260 million/year). The rapid rise of such frauds has led to
new laws being passed [17, 19], to the deployment of police task forces specifically put in charge of solving
these frauds, and to specialized help desks [15]. On the other hand, there have been so far, on average only
657 arrests and 2,859 solved cases per year [14]. Considering the lack of technical sophistication needed to
set up such extortion schemes, and the fact that bank accounts and phone numbers can be made very hard
1
100 JPY≈ 1 USD.
The Panopticlick project [11] aims to show that browser fingerprints can divulge considerable information about the user.
However, none of the One Click Fraud websites we investigated appears to use any advanced browser fingerprinting techniques.
2
2
to trace in Japan (discussed in Section 5), it appears that One Click Frauds offer easy money to aspiring
criminals.
From a research point of view, One Click Frauds offer a unique opportunity for a case study in online
crime economics. First, One Click Frauds, are extremely localized. We have not seen any instance of
this specific fraud outside of Japan, presumably due to the fact that the scammers prey on unique Japanese
cultural characteristics, such as respect of authority, or embarrassment at the idea of causing trouble. Rather
than limiting our research, we view this local aspect as an opportunity. Indeed, because One Click Frauds
are contained to Japan, and are almost exclusively used in Japanese-language websites, we can obtain a
relatively exhaustive view of how these frauds are deployed and the characteristics they share, without the
need for a complex measurement infrastructure. Furthermore, One Click Frauds, albeit unique, are very
closely related to the body of scareware scams (e.g., windows popping up trying to entice users to buy fake
anti-virus software) that are becoming increasingly pervasive, and we believe One Click Frauds offer an
interesting window in this type of criminal enterprise.
The first contribution of this paper is to collect and analyze a corpus of over 2,000 reported One Click
Fraud incidents, and to use the data collected to paint a relatively clear picture of the economic dynamics of
an instance of online criminal activity.
Specifically, we set out to answer the following questions: Who is committing these frauds? Are One
Click Frauds the product of organized criminal activities, or are they more artisanal in nature, with many
aspiring crooks trying their luck? How much do criminals stand to gain? Are there vulnerabilities in the
network infrastructure (e.g., weak registration processes, easy access to compromised accounts, etc...) that
are easily exploited by the miscreants?
In the process of finding answers to these questions, a second important contribution of our paper is to
provide monetary amounts, which help dimension the size of the One Click Fraud market, and the profits potentially made. While economic modeling of cybercrime has been an increasingly active research topic (see
for instance [12, 16, 22, 24, 35]), we believe that obtaining additional measurements and clearly detailing the
methodology we employ should help enrich our knowledge of how online criminal syndicates operate, while
assuaging concerns on the validity of the estimates formulated [13]. Furthermore, some of the measurement
methodology we employ is likely to be applicable beyond the context of One Click Frauds.
Third, our analysis methodology can be helpful to law enforcement agencies. Law enforcement typically assigns different fraud instances to specific agents, who mostly operate independently of each other.
However, we show that, by analyzing a relatively large dataset of frauds, we can extract characteristics that
are not visible when considering smaller subsets of these frauds. These characteristics can in turn be useful
to law enforcement in identifying, and perhaps prosecuting, the miscreants behind these crimes [29].
The rest of this paper is organized as follows. We review the related work in Section 2. We then
explain our data collection methodology in Section 3. We turn to analyzing the data collected in Section 4.
We use this analysis to study economic incentives for the perpetrators in Section 5, before discussing the
implications of our study, and drawing brief conclusions in Section 6.
3
2
Related work
Moore et al. contend that online crime has become economically significant since around 2004 [22]. Hence,
research in measuring the economic impact of online crime is a relatively recent field, but a number of
papers on the topic have been published in the past couple of years. We present several important advances
in the field in this section, and refer the reader to Moore et al. [22] for a more exhaustive treatment of the
literature.
Some of the pioneering work in the field has tried to quantify the value of fraudulent financial credentials
as well as that of compromised hosts (“bots”), through passive observations. In particular, Thomas and
Martin [30], and Franklin et al. [12] monitored IRC channels where miscreants attempt to sell commodities
as diverse as stolen credit card numbers, bank account credentials, or email databases for spam, to obtain
estimates of the value of these items as well as the volumes of the market associated with exchanges of such
goods.
Along the same lines, Zhuge et al. [38] describe how criminals operate in Chinese underground markets,
and provide some insight regarding some of the goods exchanged in these markets by monitoring web
forums where such items are advertised; a particularly popular item appears to be forged or stolen online
video game currency.
Passive monitoring, as discussed above, has been criticized for only measuring advertised prices, as
opposed to actual realized sales [13]. A more recent line of research addresses this concern by actively participating in the online exchanges, by essentially “hijacking” some of the infrastructure used by miscreants.
Kanich et al. [16] infiltrate a large botnet, and modify some of the spam traffic generated by the botnet to
redirect purchases to a server under their control, thereby acquiring data on spam conversion rates. The
key insight is that 350 million spam messages sent result in 28 sales. In other words, spamming is highly
ineffective, but, considering its cost is negligible, and that bots can be used to generate other forms of profit
(e.g., phishing site hosting), it remains a relatively popular form of crime. A similar botnet take-over is
described in Stone-Gross et al. [28], who monitor the type of services supported by the Torpig botnet. In a
similar vein, Wondracek et al. [35] focus on the economics of the distribution of pornographic materials, by
covertly operating an adult web server.
Perhaps closer in spirit to the methodology we employ in this paper, a significant body of literature
[20, 21, 23] is devoted to quantifying the economic impact of phishing scams, as well as the modus operandi
of the attackers. One of the main outcomes of this line of research is to evidence that a large proportion of
phishing activities are carried out by a modest number of phishing gangs, who use relatively sophisticated
“fast-flux” techniques, where phishing sites are used as disposable commodities hosted on compromised
hosts. This body of research puts the number of phishing websites at around 116,000. Likewise, Moore
and Edelman [24] gather a large corpus of data on typosquatting domains, to quantify the economic value
of such sites, as well as potential disincentives for advertisement networks to intervene forcefully. Finally,
Provos et al. [25] provide a comprehensive overview of web-based malware distribution, showing that there
are in excess of 3 million web pages attempting to infect their visitors.
The work we present here is complementary to the existing literature. To our knowledge, this is the first
time One Click Frauds are analyzed from a quantitative and technical perspective. (Research on the legal
4
ramifications and countermeasures, on the other hand, has been active [17].) More generally, we focus on
a relatively contained instance of a scam, and attempt to gather both economic data (potential revenue, deployment costs to the perpetrators...) and structural data (number of players, relationships between players,
...) through a systematic measurement methodology, which we believe can be useful beyond the study of
this specific fraud.
3
Data collection
To find instances of One Click Frauds, we rely on public forums which report fraud incidents, along with
details regarding the website being used, the amount of money extorted, as well as fraudster contact information (bank account number, phone number, ...). We collect data from three public forums:
2 Channel BBS [5]: The largest bulletin board in Japan, which provides discussion threads on various
topics ranging from Japanese anime to sports. Several ongoing threads are dedicated to denouncing One
Click Frauds.
Koguma-neko Teikoku [2]: Privately owned website providing help to solve consumer problems related
with online activities. A section of the site is devoted to describing One Click Frauds, including information
about scam incidents.
Wan-Cli Zukan [7]: Privately owned website solely devoted to exposing websites partaking in One Click
Frauds.
Collection methodology. We gather data posted on the three websites we polled over a period of roughly
three years (2006-2009). Specifically, we collect 2 Channel posts made between March 6, 2006 and October
26, 2009, Koguma-neko Teikoku posts made between August 24, 2006 and August 14, 2009, and Wan-Cli
Zukan posts made between September 6, 2006 and October 26, 2009. All in all, we gathered 2,140 incident
reports. While it is difficult to determine how exhaustive our data collection is compared to the total number
of frauds perpetrated, we note that there is a significant overlap in the data provided by all three sites, which
indicates we probably captured the most successful frauds, and that our coverage is likely adequate.
Initially, we also tried to extract information from data provided by the Japanese police [31]. Unfortunately, these reports are in image format, and do not contain much actionable information, even after using
optical character recognition. Indeed, most of the interesting details (e.g., bank account used) are often not
divulged.
Data parsing. The three sites present marked differences. 2 Channel is based on anonymous postings from
various users who have encountered a One Click Fraud website and post notifications to other users. Due to
its popularity and large user base, 2 Channel contains a wealth of information. However, because 2 Channel
threads are essentially an open discussion, parsing the data for useful input is challenging. Koguma-neko
Teikoku is also a collaborative web space, but, different from 2 Channel, Koguma-neko Teikoku requires
posters to input information about One Click Frauds in a specified format. Finally, Wan-Cli Zukan is closer
to a blog, where the website owner periodically posts notifications in a fixed format. Outsiders cannot
directly post to the site.
5
Parsing the data from Wan-Cli Zukan and Koguma-neko Teikoku is straightforward, as both sites use
a predetermined format for all posts relevant to One Click Frauds. Likewise, the data is of high quality.
Randomly sampling the reported sites, we did not find a single instance of slander – i.e., benign sites which
would be reported as fraudulent. Either the sites reported were, indeed, hosting One Click Frauds, or they
had been recently taken down.
Figure 1: Example of 2 Channel posting. The lack of structure makes parsing slightly complex. Here,
usable information is only contained in the squared area; oftentimes, formatting is even more haphazard.
On the other hand, 2 Channel is considerably more challenging to use. An example of 2 Channel posting
is shown in Fig. 1. Since the data is not formatted according to a specific standard, we have to perform some
basic text segmentation. Adding to the difficulty, is the fact that the Japanese language has comparatively
few punctuation rules. For instance, words are rarely separated by spaces, there is no capitalization, and
most characters have a couple of different readings depending on the context. Furthermore, in forums
like 2 Channel, specialized slang and abbreviations are the norm, rather than the exception. To perform
text extraction, we use the MeCab parser and data analyzer [4]. MeCab extracts Japanese characters into
semantic units. This allows us to obtain a list of tokens, such as “ginko” (bank), “Sumitomo” (name),
“hutsuu” (usual), “1234567.” We can then perform context-dependent parsing. The previous series of token
tells us that it is highly likely that the poster talks about a “usual” checking account number 1234567 and
Sumitomo bank.
6
Data source
N.
2 Channel
1077
Unambiguous, w/ URL
Unambiguous, w/o URL
Ambiguous, w/ URL
Ambiguous, w/o URL
Koguma-neko
records
353
174
218
332
372
Unambiguous, w/ URL
Ambiguous, w/ URL
Ambiguous, w/o URL
Wan-Cli Zukan
2
362
8
691
Unambiguous, w/ URL
Unambiguous, w/o URL
632
59
Table 1: Number of extracted fraud incidents from each source.
Despite the added difficulty of parsing 2 Channel threads, we did not encounter any erroneous or libellous postings. While a certain level of verbal abuse is present in such an unmoderated forum, it is easily
separated from relevant information, once text segmentation is performed.
Extracted attributes. For all three sources of data, after having parsed and cleaned the input, we extract
the following attributes: URL of the fraudulent website; Bank account number given by the fraudster for
remittance of funds; Bank name; Branch name; Account holder name; Contact phone number; Registration
fee requested (i.e., amount of the fraud).
Some of these attributes (e.g., account holder name) are probably fake. However, for the fraudsters to be
able to receive money, the financial information has to be genuine. Likewise, contact information (email and
phone numbers), when present, is usually accurate, as miscreants provide the victims with a way of “calling
back” to further their social engineering attacks.
Table 1 describes the number of fraud incidents that we extracted from each of the three sources of data.
Note that, these sources are not mutually exclusive. In fact, we have significant overlap between the different
sources.
Second, the raw data that we extract needs to be cleaned up significantly. A number of records are incomplete to some extent (missing phone number for example); out of these incomplete records, particularly
problematic are records that do not contain a URL field, as the existence of a fraud cannot be verified. In
addition, a number of records are ambiguous in that some fields have more than one entry. For instance, a
given post may contain one URL but several phone numbers. Most of these records need to be scrutinized
manually, to check whether parsing was done correctly and whether the record indeed contains several fields.
All results are stored in a MySQL database. We illustrate a typical entry in our database in Table 2. To
help make our experiments reproducible, we make a copy of a dump of our database available (in gzip’ed
7
form) at http://arima.ini.cmu.edu/public/oneclick.sql.gz.
After having cleaned up our original dataset, we use the extracted URL to infer the domain hosting the
fraud, and, whenever possible, to obtain registrar (“WHOIS”) information. We also periodically download
the corresponding website (using wget in recursive mode) to check for potential changes indicating a takedown, and to check for the presence of malware on the fraudulent site.
Note that, due to the time interval (three years) over which incident reports we collect were reported, a
significant amount of data points to sites that have long been taken down. Thus, a number of records are
hard to verify and may be missing information. For example, we have a smaller number of entries with valid
DNS domain information, compared to the number of incidents reported.
ID
Date posted
URL
370
2007-02-03 00:00:00
http://www.331164.com/
IP
Email
Bank
69.64.155.122
[email protected]
Sumitomo Mitsui
Branch
Acct. Type
Acct. Number
Koenji
Checking
7184701
Acct. Holder
Phone #
Fee
Takahashi, Mizuki
080-5182-7956
JPY 88,000
Table 2: Example of database entry. Note that not all attributes can always be extracted.
4
Data analysis
We next turn to analyzing the relatively large corpus of One Click Frauds we gathered. Specifically, we
seek loopholes in the infrastructure that attackers are able to exploit. We then try to assess some of the
characteristics of the online criminal market behind One Click Frauds, and in particular, investigate whether
some miscreants are responsible for several frauds. Last, we try to determine whether fraudsters engage in
other illicit activities beyond One Click Fraud.
4.1
Infrastructural loopholes
We start by checking our data corpus for evidence of repeating patterns in the attributes we collected. The
idea is that, departures from usual patterns may indicate evidence of vulnerabilities in the infrastructure. If,
for instance, a disproportionate number of frauds uses bank accounts at Bank X, one can reasonably infer
that Bank X processes for identity verification and account establishment are flawed.
We first consider the phone numbers used by fraudsters. We are able to identify the phone number
used for callback in 516 separate incidents. We check the phone numbers in our database against the phone
number ownership list published by the Japanese Ministry of Internal Affairs and Communications. We find
that 38.6% of the phone numbers used in One Click Frauds are au cellular lines, 23.3% are Softbank cellular
lines, and 16.5% are local landlines for the Tokyo area. A 2009 report about the Japanese cellular phone
8
Registrar
Market share [34]
Go Daddy
29.08%
ENom
8.30%
Tucows
6.82%
Network
Solutions
6.06%
Schlund + Partners
4.38%
Melbourne IT
4.34%
Wild West Domains
2.89%
Moniker
2.43%
Register.com
2.40%
Public Domain Registry
2.17%
Registrar
Prop. of frauds
ENom
47.56%
GMO Internet
17.48%
Above
5.14%
Go Daddy
4.11%
Tucows
3.34%
Key Systems
2.83%
New Dream Network
1.54%
Abdomainations
1.29%
All Earth Domains
1.03%
Dotster
1.03%
Moniker
1.03%
OTHER
13.62%
Table 3: Registrars used in One Click Frauds. The left table shows the market share of the 10 most popular
registrars (and thus does not sum to 100%). The bottom right shows the 11 most frequently used registrars
in One Click Frauds, along with the respective proportion of frauds they host. Numbers are obtained out of
the 389 fraudulent domains for which WHOIS information was accessible.
market [33, pp. 78–79], tells us that au has about 25% of the market share, while NTT Docomo represents
about 50% of the market. So, it appears as though au cellular lines are disproportionately targeted by
fraudsters. Whether this is due to lax registration practices, or to easier access to compromised lines, is
unclear. The large proportion of Tokyo numbers may be explained not only by the amount of population in
that area, but also by the fact that most forwarding services, which redirect all incoming calls to a different
number while preserving the anonymity of the callee, use Tokyo numbers.
Next, we identify the bank used in 803 separate incidents. We observe that online banks tend to be
slightly more represented in these frauds than their actual market share should warrant. For example, 116
frauds (14.44%) use the online Seven Bank. On the other hand, this bank does not have a significant market
share in Japan [33, pp. 82–83]. eBank and JapanNet Bank are two other examples of online banks used
at a notable level (around 3%) in One Click Frauds, while holding only a small market share. A possible
explanation is that online banks do not require a physical interaction to let individuals open an account, and
are thus potentially more prone to abusive registrations.
We observe even more interesting patterns, when we look at DNS registrars and resellers that are abused
by fraudsters. Table 3 compares the market share, as of Nov. 2009, of the top domain name registrars [34]
with the proportion of registrars used by domain names participating in One Click Frauds. We are able to
identify the registrars used in 389 incidents. We note that ENom is apparently much more victim of abuse
than other top domain name registrars. Likewise, Above and GMO Internet rank highly with fraudsters,
while not having significant market share. This result can indicate one of two possibilities: Either these
registrars have very lenient registration policies, or they entrust some of their domains to resellers that are
9
40
co
m
3.
m
ai
do
n.
co
m
.co
ia
ed
ie
m
.co
m
de
co
80
lli
tre
x.
sv
dn
an
jp
.co
ss
pa
e−
fre
5
m
ov
m
ix
m
10
m
.n
et
ho
am
dr
e
15
st.
e−
lu
20
co
do
m
m
ai
25
ed
30
va
Number of websites hosted
35
0
Figure 2: Number of websites hosted by the resellers used in more than one incident.
not perfectly scrupulous.
To find out which domain name resellers are used, we examine the DNS field in the WHOIS record
associated with the domain used in each One Click Fraud. A large number of sites we investigate have been
taken down (particularly those obtained from 2006-2007 sources). In some cases, though, the One Click
Fraud sites have been replaced by domain parking pages, and thus still have valid WHOIS information,
which may reveal information on the reseller used. Another large number of sites use either their own DNS
server, or free DNS services like opendns.com, and are thus discarded from analysis. We complement
investigation of the WHOIS DNS fields with a simple reverse DNS/DNS lookup script. For instance: dig
+short admovie69.com | xargs dig +short -x yields ikero.dreamhost.com, which tells us the web
hosting service is dreamhost.com.
We eventually manage to identify the resellers in 97 incidents. In Figure 2, we graph the number of
at resellers that are used in more than one incident. We note that, for our successful lookups, a couple of
resellers (maido3.com, value-domain.com, ...) appear to be highly represented. They tend to be
cheap resellers, with lax, or absent registration checks.
Specifically, we investigated further maido3.com. We used a disposable email address to request
rental of a specific domain name and server space. We used a fake name, address and phone number,
which could have been easily spotted, as the address was that of a famous subway station. We received an
immediate response with invoicing details. A simple money transfer was all that was needed; and this could
be performed anonymously by using cash at a convenience store. The reseller promised the site would be
up within 30 minutes of the payment being sent. No identity checks were ever performed. In other words,
this specific reseller can be easily abused for fraudulent activities. While we have not attempted the same
type of test with the other “popular” resellers, we venture to guess that their registration processed are likely
easily abused as well.
10
4.2
Grouping miscreants
We next attempt to determine whether we can find evidence of organized criminal activities through miscreant behavior. In this paper, we qualify by “organized criminal activity” large scale operations involving
many frauds, using a considerable number of bank accounts and stolen or abused phone lines, and possibly
coordinating with other organizations to deploy malware or share stolen information. We contrast such large
scale operations with those involving only a couple of sites.
Methodology. We define an undirected graph G = (V, E) as follows. We create a vertex v ∈ V for each
domain name, bank account number, or phone number our database contains. Then, we connect vertices
belonging to the same fraud with edges E. For instance, if our database contains an entry for a fraud
hosted on example.com, with bank account number 1234567 and phone number 080-1234-1234, we add
(v1 , v2 , v3 ) = { example.com, 1234567, 080 − 1234 − 1234} to V , and three edges (e1 , e2 , e3 ) = {v1 ↔
v2 , v1 ↔ v3 , v2 ↔ v3 } to E. Note that, by building the graph G in this fashion, two nodes of the same type
(domain name, bank account number, phone number) never link directly to each other, but can be connected
through an intermediary. For example, two websites using the same phone number result in a connected
path between the three concerned nodes. One natural question is why we chose not to link two different
domain names pointing to the same IP address. The reason is, that we realized that this happened sometimes
for sites that were markedly different, only because they were co-hosted on the same machine by a common
reseller. In other words, both incidents shared the same web hosting provider, but were not related otherwise.
We decided to err on the side of caution, and not to consider identical IP addresses as a strong indicator of
identical ownership.
Parsing the entire database yields a graph with 1,341 nodes and 5,296 edges. We first isolate 26 “singletons” representing connected subgraphs containing at most three nodes, and at most one domain name,
one phone number and one bank account. These singletons represent incidents that we cannot connect to
any other fraud. All “one-off” scams fall in this category. Excluding the 26 singletons, the whole graph G
contains 105 connected subgraphs (“clusters”), with sizes ranging from a couple of nodes and edges to a
large cluster containing 179 nodes (56 domains, 112 bank accounts, 11 phone numbers), and 696 edges.
We plot the graph G in Fig. 3. While the specific domain names, phone numbers, and bank account
numbers are not readable at this scale, we can clearly distinguish the connected subgraphs, which are ordered
in separate boxes in the figure. The presence of large connected subgraphs (e.g., top right) indicates that
some miscreants are operating a large number of sites, and are reusing phone numbers or bank accounts
across several sites.
While it could, in theory, be possible that two completely different criminals share an identical bank
account number, we reject this hypothesis, as the bank account numbers used have to be valid for the
criminals to collect their dues. Hence, a shared bank account number means that, at the very least, the
miscreants sharing the account are in a tight business relationship, and probably are the same individual or
group of individuals. Likewise, because phone numbers used in these frauds are genuine, reusing the same
phone number across several frauds indicates a business relationship between the perpetrators.
11
angel−blog.jp
franky−tube.com
0352183
0414092
441583
0225110
7160136
5329658
0331261
cutieluv.net
08011594469
0363802956
1619457
himawari−blog.com
0792520388
1641074
hanabi−don.com
bukkakex.net
1470805
8860037
0386661
1078564
0358519965
moon−a.com
8842125
a−milk.net
09091503831
1953945
5317013
1657050
nip−go.net
ad−hole.com
1209448
bubble−gum.jp
6311731
0894719
jannie.jp
2037698
1611762
204246
357089
little−ag.com
3956232
beguru.jp
7595857
1351803
movie−love.com
subi−ing.com
juku−juku.com
sexy2.jp
1340013
374480
cha−nel.jp
0358519962
0332860
bubuko.jp
tirallin.com
1637788
alsoira−p.com
1391139
a−file.net
5333906
a−vivi.net
coro56.com
1494273
3156739
0120555061
tv−adult.net
5092915
meron−pan.com
1194160
pyuride.com
4099066
347670
avclinic.net
1638224
7019885
best−mov.com
cinderella−movie.com
nurenuremanko.com
0351715
3779326
1999395
idol−douga.jp
3161820
4041614
hateblog.jp
346902
08031241652
1675648
216072
08065323977
mermaid−haisin.com
7810164
adult−collection09.net
1078676
08011659432
0330248
info.net
1426302
0358519964
0358519961
09088123505
5329569
341687
4044113
1418160
0157663
0120540940
4032599
grin−2.com
0349541
7696035
adult−dream.net
5328716
cheezu.net
0340035
gal−star.com
370195
adult−player.net
nasubi−ing.com
1219556
5092923
1633117
aitaiyo.jp
1637730
9061683
paradise−fish.com
bettyser.com
peppar.jp
5092702
376896
08053424771
340276
1164647
0332144
cherry−move.com
masa−mune.com
08034984656
3099458
0208028
love−gal.com
frury.com
0346902
280138
428410
2425448
e−sweets.jp
5329542
375644
puni−2.com
love−aware.com
0588566
yamato71045.com
210943
5379464
mmbga.jp
nyaa−nyaa.com
merumon.com
lovechop.net
value−engineer.com
08065257334
0423842
1518850
1012826
7716465
0339501
slim−slim.jp
1487263
imazin.net
1010447
4539234
1651498
1865756
1950977
3441540
1759710
5340708
8696942
0360423
0358199234
05055330214
1083439
adult2.net
4084239
h−−ko.com
09017051122
08066575324
1185845
utubu.net
5093385
0388841
itigo15.jp
moe−moe.cc
whitelover.net
08066189305
3566662
0232729
0353528
cherry−love.net
douganews.jp
entameblog−seasea.net
8453987
09035485924
5336328
4073881
3375458
0359850337
0384968
312788
5543841
1391210
eroscamp.com
tendencys.com
722297
08066246703
qq−o−pp.com
389841
3175577
0120964819
0388018
malilin.net
cross−road.info
294566
qqqja.com
3011261
340312
entainfo.com
nixy.jp
0314398
0280138
382437
1125163
08035251179
6311758
free−dom1.tv
08033857316
1439051
6320366
1640981
343691
2688261
0120948843
0350164
cross−mode.net
11066531
ero−para.net
0388369
3271716
0354160
5333884
5095507
banana−gal.net
0475367
baxxyy.com
0465175
5333281
0418224
0589849
241683
344238
prinprin.net
5096597
global−hotline.org
08032515119
5091951
0325032
235900
0359389
0333212
club−cc.com
7630009
0372671
1670973
anything−c.com
makkey−k.com
08053422904
hi−quality.net
0383644
1998870
08061313149
bi−tiku.com
5421018501
8140429
chocoblo.com
0344784
7222297
tikantitai.com
08056979249
4746756
1806363
08012452071
1482222
0388902
6618793
movie−pie333.com
entarou.com
2063510
08061313142
0001963
smile2007.jp
1641759
0251320
08034984657
1406720
4538271
entameparadise.com
1740643
fresh−tube.net
1644890
5328724
8476199
0624983
0209571
08035910928
5339815
0340004
5262219
eroerolove.com
09099538764
0388570
3969268
nurevideo.com
oreoreo.net
0387134
moco−2.com
5319725
371234
sexy−pororin.com
4032244
muchihip.com
0326316
1998098
0387133
3079568
0014313
1090428
08038207711
0344238
adult−moody.com
5333892
5335194
0353548
1051811
mukekuri.org
0329405
5332951
08054299771
0354038
ss−class.com
adult−princess.com
campus−love.jp
nukimedo.net
6649945
5046551
0661853000
2172159
3855981
5319717
09093671734
hanabi−after.com
todaysmovie.sakura.ne.jp
todaysmovie.net
6338532
5333931
1455876
0404455
5329704
porollin.com
hamepara.com
4093947
anahime.info
hamekura.com
4090697
0120166335
1086185
mcnsd.com
0358475699
1477522
marmaid.cc
kiss−of−adult.com
1414113
0331970
5343057
08020542531
h−love.org
5093369
0448745
77756
5329909
1452331
2660037
3173405
08032435833
7251423
0344551150
angelsabc.com
1492268
0363806168
1627942
1290679
0350269
1941897
0658736
okazustation.com
1628498
erumo.jp
7700913
6746509
2013974
bisyo2.net
0363806070
entaenta.com
4695553
mac−mac.jp
0357744311
4053334
lady−impact.com
09083035035
09029127977
09035487922
april1980.com
ss−class.net
0493515
2833320
6523649
345041
09055871914
09060167620
8226311
march−2008.com
channel.jpn.ph
honeypoo.jp
erojiro.com
08055079961
0359999229
3481058
adult−dougaga.com
yaplog.jp
0404128
lovediscovery.net
2952751
vvindows.jp
oman5.com
6044604
09012122826
4017085
08068165797
channel−av.net
rivianan.com
5333485
4087416
08065409987
nureyubi.org
movie−h.com
4040027
geinouflash.com
1065019
1237177
1634727
3095372
09018030721
09047285631
hot−spot.cc
dougadx.com
1801712
quicklegs.org
mokko−gals.info
akume55.net
ktkr.cc
adult−55.com
8290452
2313128
idolroom.net
hitodumah.net
deepero.net
1107515
baby−cat−be.com
deeper.bz
bgmovie.org
1609126
girl−mix.com
otakara−max.com
mihoudai.com
be−movie.org
1521668
0411692
sagjo.com
sweet−tenn.net
09017729724
6811034
idol−mania.net
kaZnetmovie
1383371
news−club.jp
3783847
nozokix.cc
1734316
3146656
onaona.org
m−hunter.net
0384305
5157963
1583507
bm−mov.com
m−o−v−i8−es.com
0364576191
09045665062
mv69.org
admovie69.com
peroman.net
5313573
469831
honey−cute.com
mv−love.org
bgmv.net
0352925692
1301074
3510627
1005560
1143219
1383733
star−77.com
337767
pineapple−express−the−movie.net
rev−02.com
6672662
erogazo.net
0364576188
orange−girl.net
mvx55.org
08054295269
big−pink.net
4037555
erostube.muvc.net
433515
8094341
8975641
3494150
h093.com
gal−xx.net
goo−leak.com
1739475
candysweet.cute.bz
girl−box.net
mv−hunter.com
0120696403
09044522789
ero−anime−star.com
candy−sweets.net
6954047
hasikue.net
d−xxx.net
nukikko.net
4079227
0360843
0120964231
2182619
mania4u.net
tere.site.ne.jp
4443129
0359445
0369194966
1120635
08012315407
09038178656
av−flash.net
09060439730
movie−tubes.com
4058108
09061234110
0450617
bmov.bz
08055089225
2578585
1887032
aneona.com
movierock.info
1648593
adult−ch.com
cyberpro−wingsmember.com
vip−ch.com
3803329
coolwatch−dramaplayer.com
fpretty.net
chizyo−takyuubin.com
5416593
gazobank.net
3103382
3091434
crystal−mv.org
4068802
temomin.net
eroking.net
adult−maniac.com
wink69wink.com
veoh−box.com
guba−cafe.com
0396753
view−break.com
aidol−o.net
0334074911
3698289
dlxmovie.org
8410192
0398437
8538560
myvideo−viewwatch.com
ero−izm.com
fmv−str.com
samehada.com
359445
tokyo−vi2.com
olioli0.com
0412752
5242684
free−wmv.org
f−xxx.net
frx−video.info
strmv.org
0417728
e−adults.net
1121928
4044638
freehp.cc
5339572
5337294
eroerotv.com
6583868
2222472
f−cute.com
fxe.bz
mvdx.net
1933624
high−time.jp
08065329727
0349375
0338530
x69xforyou.com
nkjnk.com
runkhead.net
4082665
1619966
d−per.cc
4045172
0421581
1869828
fe7.org
elephin.net
kakecat.com
0776395
09017387584
7361520
gi2a.net
0354671057
09061860948
8042012
4370852
5340104
erox−mov.info
cream−angel.net
srmov.net
erocinema.net
09012739052
sexy−shake.com
8065331
0321104
eroero−movie.net
08067622371
hs34.drive.ne.jp
1529859
5165068
ozari.com
0425703
4045610
6985815
shin−girl.com
1144859
4009193
erotown.biz
1780456
eroing.net
eroooo.com
main69.sc
extasy−sp.com
6992785
09018377611
m2mv.net
pinky−camera.net
o1111.com
1556604
2878099
ony−hand.com
cos.com
0403850
2866908
1535848
manko−siohuki.com
2824040
0353389795
10228026
x−archive.info
2012854
download−page.net
puru−2.com
0303133
angel104.com
602741
triqwe.com
nuki−movie.com
1829553
0383656
pearl−movie.net
6580923
pakipaki77.com
ureqky.com
cherryboy.jp
2000207
1352754
0333718464
08038262976
eroero−story.com
elite−elite.jp
5341747
09018376843
4029118
4648516
340174
0222917
5297837
goldmedia9.jp
0378050
strmovie.net
306390
heidi−alps.com
3324574
363010
mov−x.org
erowiki.net
otkrd.net
09065662100
09047379105
tinko4545.com
shakuhati1919.com
ee−movies.net
o−takara.org
bb−download.net
free−tube.girls−jp.com
1622740
1040522
4076368
419223
08040118481
download−max.net
595799
0402931
q−vide0.com
08038254756
splash−net.jp
ari−.com
bottob.net
0387486
5340724
4941192
7769426
0120078310
8083492
0369632
0306583
ex−d−ex.net
2312521
o−tin.com
0347916
1647361
4040791
0598054
35122
1601834
0120100479
dream−−maker.com
momoiro−time.com
0029786
5101517
1453920
0354562488
6232755
zest−movie.com
1221882
cokimaro.com
08054597956
4584380
medo−hole.org
movie−factory2.net
6341843
5336573
3660931
0353530
mega−movies.net
0385093
0318332
1028012
09061861058
0385094
1630265
movies−max.com
0385203
muteking.com
0369129513
oppai777.com
download−vi.net
nurenure−movies.com
0351310
eroero−aidol.net
0563215
adult−juice.net
5318168
0343550
1813378
moro−movies.com
cherry−pie.info
5336778
3213568
free−share.jp
1103645
9985692
08035110306
1458789
1238350
0104697
0358425
0362689
0364500337
1369144
0225244
0364500338
adult−69.com
0312320
ananan.biz
0727136
1343757
yamato.power.ne.jp
0387514
1030147
7541792
4038252
08012493978
0292684
0135448
6948954
playgirls.cc
0050056
lastsong2007.com
1537062
0348126
5337316
5341071
0120707473
1659678
08013471667
adult−99.com
0333082
1928070
ad−sexy−gallery.com
1648063
0298759
a−mn.net
478971
ero−max.biz
1767396
1929784
1635833
0162390
1064348
1637561
08013416995
09040026096
6547551
0406009
2348872
230141
ad−maruhi−club.com
5323609
peach−candy.com
good−eros.com
0326011
all−look.net
08066293236
09044356307
0315494
09064957153
0163237
2808142
382555
pichipichipi−chi.com
cute.fm
0387239
specialdouga.com
08035110321
0161761
1105738
0371964
09061860949
beauty−movie.com
0561112
09098068443
8459883
daichuki.net
0385858
0387480
5317757
0286196
2039800
sexyhathurathu.com
ikuru−to.com
2124627
6630471
0361645
pussy3.net
blog−ex.jp
0154039
0503632
0339477
0373205
0385460
0347038
mars.server.ne.jp
0385099
0063338
arukonda.com
saunin.com
0403627
0380906
0389994
3878842
0356547159
1120502
okazu−ch.com
5321550
5336565
cyuraman.com
0120540412
0145000
gazo−xxx.com
pink−gals.com
adult−vision.net
3114035
hippai.net
0354283294
0331806
5218287
3077810
0354456
08051827956
2122373
08051893069
movie−downloadpage.com
0393511
1613892
09098057510
334604
4049462
0382799
h−erorist.com
eroize.net
5097338
08066789998
kyoto.direct.ne.jp
1434040
4044105
manboo.org
6964085
08013481402
nakatayu.com
adult−moviespecial.com
ero−station.net
0343433
tadaudo.com
08051825872
momotube777.com
0441247
0478971
0400517
3262040
1161106
0354283599
1096017
1176575
5244068
1036604
.info−e.net
sexsexsex.bz
1033360
0375460
3479977
8455994
nishinom.uuuq.com
click−gazou.com
doshirouto.net
2051963
adultportal.bz
5338576
1056961
0261679
otakara−com.net
3348130
movies−navi.net
urageinou.com
syogekiotakara.com
7552399
1369219
7019393
0069417
1647116
5878056
6132458
1126505
geinoulive.com
1702309
6239687
08030288578
hiroimonoblog.com
1953517
shirotopara.com
hitozuma−jukujo.com
5392821
uploadotakara.com
7512014
freefree−geting.com
5084203
e0721.com
e−horidashi.net
1680370
08067744832
sukebe4545.com
1447503
1343544
freemovieshelter.com
cupid−f.com
0104838
purememo.jp
nurunurujp.com
treasuremovieplayer.com
index−pv.com
pyupyupyu.net
0084305
5213007
0343162
1507237
hwrws.com
1997477
2429766
4467772
6966760
1647622
paradise−cafe.tv
0352924176
tokudane.cc
09034142427
08066293227
1658483
2429774
5346307
1502037
2683998
kamehamema.com
asite2006.com
adult−media3.com
0421384
milkpai.net
1691135
333289
afg.adfack.com
0175290
ctg.adweeb.com
5695927
09034178215
petit−devil.com
sikosiko55.com
0387595
4058270
0337680
tch.adweeb.com
08066164856
geinoudaisuki.com
1404764
pink−apple.net
08061148266
garumin.com
0426326
6599861
0577251
0357849501
0402084
0306538
onanny.net
tohkof.adfack.com
shake−hip.net
0525881
ree.adweeb.com
0357849235
5342131
gss.adweeb.com
8059603
3442456
materiaru.com
0388662
1267396
0388283
jyukujo−hitoduma.com
0374643
0120937959
4026601
apk.adflash.net
4026092
09094023036
09010425485
fgter.com
bfg.adweeb.com
08061332300
3791080
0352343
0284256
5337731
0425520
takuero.com
adalt−world.com
boinpururun.com
0352924109
tst.adweeb.com
1629329
09058210093
0352924033
love−green2.com
tpl.adweeb.com
0558445
6191072
wintube.net
0583821
4084869
09098564796
6476397
0387593
lovelyhoney.adgoo.net
1015584
youradult246.com
0179561
0293921
3532049
08067242335
.eromajin.net
gsg.adweeb.com
1473244
0451712
1633362
2452834
0376574
1623524
hat.adweeb.com
hame.adflash.net
09084891165
hamebank.adfack.com
6600282
08053276846
5406408
tom.adweeb.com
idol−get.net
kewpie.tv
2848342
4993545
2066983
0274806
0335845177
starpeach.net
1182422
09017936613
hcl.adweeb.com
0389948
geinouplus.com
youxtube.org
7685526
0374386
pararin.net
trinions.com
4601959
stx.adfack.com
tof.adweeb.com
113095
1414431
5374157
1717689
3039599
08065920249
galooon.com
videochannelfile−mackintoshlive−movie−tv.org
douga−dx.com
3379998
8506951
yourtubefile−userforplayer−live.com
1174307
0437281
okazumovie.net
okazu−movie.com
09029094733
3509866
wintube.info
1611645
mycast−watch−tv.com
tohsen.adgoo.net
08065290249
dougadx.net
6099079
forjustvideo−javadownload−watch.info
cross−mode.com
0382127
0445224
0164722
0414077
1166179
3969195
3090009
0335604975
sweet−tube.net
samplefreemovie.com
4517418
inf070614.com
r18shitei.com
1221456319
05055335807
shibuya−supa.cocolog−nifty.com
0630719
4062966
0338829851
1970262
0350762
08065306995
4087017
youtude.name
2004024
0001682
0354598
0339320
1556490
0100145
1805992
yaritai.jp
4035520
1281040
yariyari−doga.com
08065920448
impactfreemovie.com
pp−juice.com
blog.kimikasa.com
6309257
he−collection.net
08034562094
1249683
0359850128
1022465
1038001
0383417
3008409
0339122
2005096
1776495
3032557
5372812
0300391
exite−tube.hot−jp.com
e−gossip.net
onaona−doga.com
0329168
youtude.jp
8918683
08036386304
love−cast.net
3107493
0507462
0187633
0279570
3177715
movie−adult999.com
eroeromax.net
7202108
cbehs.com
08067403774
08066706829
0375568
xootech.net
adult−fish.com
1080791
0352180
5651810
1663667
mediachannel−windowslive−tv.net
4021054
pure−doga.com
0357505273
nukenukidoga.com
shirouto−av.com
softnbank.com
v−gallery.net
ero−gappa.net
ero−tube.jp
08067441280
0272017
eroceleb.net
0638152
adult−007.com
0358475692
09061017344
2551129
0062260
2046533
9348390
mo−movie.com
0353021978
1662373
3131092
6723957
venus−gate.info
1632202
0451981
1282599
7027611
0362807977
09065000870
0338829852
0333758325
moe−roli.com
h−tuma.net
0362807950
1471895
0120404306
5392597
onenight−movie.com
brabus.xsrv.jp
7864096
Figure 3: Clustering of 1,341 nodes representing 481 domains (ovals), 684 bank accounts (triangles),
and 176 phone numbers (small rectangles). Links connect nodes found in the same incident. We obtain
105 clusters containing more than one node, and 26 singletons (omitted from the figure). Additional grouping by malware used allows to link seven of these clusters into two groups (denoted by dashed lines), and
additional grouping by strong similarities in WHOIS registrant information allows to group another set of
seven clusters (represented by thick lines).
12
Malware. We further noticed that websites from the second largest connected subgraph were still alive as
of Nov. 2009, indicating that the fraud continues unabated. As mentioned earlier, we downloaded the entire
contents of each fraudulent website listed in our database. We found that a small number (14) of One Click
Fraud websites contained some malware.
Specifically, some of these sites contain a virus named Trojan.HachiLem. This is an MS Windows
executable file which is posted on these sites as a “mandatory video viewer plug-in.” Once downloaded
and executed, this virus automatically collects email addresses and contacts stored within Outlook Express
or Becky! (email application popular with Japanese enterprise users), and sends the collected information
to a central hachimitsu-lemon.com server and, possibly, to another machine as well. The collected
information is in turn used to send blackmail emails to victims and notifying them they owe the website
registration fees. Interestingly enough hachimitsu-lemon.com has not been a valid domain name
since, at least, early October 2009, but a report about this virus was posted as recently as Oct. 26th, 2009 on
Wan-Cli Zukan, indicating that this virus is still mildly active.
Another group of sites contains a simpler, less intrusive form of malware, which modifies the Windows
registry entries to display a pop up window reminding of the registration fee due upon boot-up.
Additional clustering. An interesting feature of the sites hosting the Trojan.HachiLem malware is
that they all share strong similarities in their WHOIS records. For instance, the technical contact phone
number field contains is identical (+81-6-6241-6585). While it is likely a bogus number, this similarity,
coupled with the presence of identical malware and overall similar appearance of the different websites
involved strongly suggest all sites are operated by the same group. We can thus relate three connected
subgraphs to each other, represented by the dashed boxes in Fig. 3.
We further look into WHOIS information details, and notice that a number of registrant entries shared
similarities across seemingly different incidents. For example, we found a number of entries with identical
(bogus) contact name, email information, or technical contact phone number. By grouping this entries
together, we can link seven connected subgraphs, represented by the thick boxes in Fig. 3, to each other.
Cum. prop. of webs. maint’d
Nr. of websites maintained
60
50
40
30
with additional clustering
basic clustering
20
10
0
20
40
60
Group rank
80
100
(a) Nr. of frauds perpetrated by each group.
1
0.9
0.8
0.7
0.6
0.5
0.4
0.3
0.2
0.1
basic clustering
with additional clustering
20
40
60
Number of groups
80
100
(b) Cumulative number of frauds
Figure 4: Frauds distribution over the miscreant groups. These plots exhibit considerable concentration
in fraudulent activities.
13
Fraud distribution. With the assumption that each connected subgraph denotes a unique criminal organization, we plot, in Fig. 4, (a) the number of frauds perpetrated by each group, and (b) the cumulative number
of frauds perpetrated by the most active fraudsters.
In Fig. (a), we rank criminals by the number of frauds they have been committing, and plot the number
of One Click Frauds perpetrated by each group as a function of its rank. We provide data for both simple
clustering (based only on phone numbers, domains, and bank accounts), as well as additional clustering
(further grouping criminals by malware used, and identical WHOIS records). We note that the distribution
seems to be following a Zipf law. Specifically, the curve representing a basic clustering fits very well with
the function y = 56/x0.76 ; y = 80/x0.90 is a good fit for the curve obtained by considering additional
clustering. The match with a power law indicates both high concentration (a few people are responsible for
most of the frauds), and long tail behavior (many people participate in these scams).
We validate this observation with Fig. 4(b). Fig. 4(b) plots the same data as Fig. 4(a), but in a cumulative
fashion. What we observe here, is that even with our conservative clustering strategy, the top 13 miscreant
groups are responsible more than 50% of the fraud. Taking into account similarities exhibited by WHOIS
records, and malware deployment, we observe that the top 8 groups are responsible for more than half of
the frauds we have collected. At the same time, there is a large number of groups that do not seem to be
involved in more than at most a couple of frauds. Including singletons, 80 out of the 112 groups we extracted
using additional clustering, or about 71% of the criminals involved, appear to operate at most two sites. This
number may be an overestimate, since we do not claim that we managed to establish all possible links that
exist. Yet, it tends to indicate that the miscreant population is a mix of large operators, and of “artisans”
running much more limited criminal enterprises.
4.3
Evidence of other illicit activities
Blacklist
Purpose
Nr. hits
cbl.abuseat.org
dnsbl.sorbs.net
bl.spamcop.net
zen.spamhaus.org
combined.njabl.org
l2.apews.org
aspews.ext.sorbs.net
ix.dnsbl.manitu.net
Google Safe Browsing (URLs)
Google Safe Browsing (IPs)
Open proxies, Spamware
Spam
Spam
Spam, Trojans, Open proxies
Spam, Open relays
Spam, Spam-friendly
Spam
Spam
Phishing, Malware
Phishing, Malware
7 (2.55%)
22 (8%)
4 (1.45%)
23 (8.36%)
4 (1.45%)
90 (32.73%)
11 (4%)
4 (1.45%)
0 (0%)
44 (16%)
Table 4: Presence of One Click Fraud domains in various blacklists.
Next, we try to see if domains engaging in One Click Fraud are also supporting other illicit activities.
Out of 1608 URLs present in our database, we extract 842 domain names. These domains resolve to 275
14
unique IP addresses.3
We check the 275 IP addresses against a set of eight blacklisting services that flag IP addresses known
for producing large amounts of spam, and/or trojans and malware, and present our results in Table 4. While
some of the domains are also used for spam, the vast majority does not appear in any database. In fact,
most of the hits we see (in L2.apews.org) are coming from sites that resolve to a parked domain IP
address. That is, these sites are not active as One Click Frauds anymore, and have been reclaimed by the
DNS reseller, which apparently either serves as a spam relay or has been known to be friendly to spammers.
Given the results we found earlier about the concentration of frauds in some specific resellers, this outcome
is not particularly surprising.
We further verify this hypothesis by checking our entries against the Google Safe Browsing database
distributed as part of Firefox 3, updated as of November 15, 2009. On the one hand, none of the URLs we
find in our database is listed in the Google Safe Browsing database. On the other hand, when we check IP
addresses of the servers that host One Click Frauds against the IP addresses of the servers hosting pages in
the Google Safe Browsing database, we see a significant (16%) number of hits. This confirms our finding
that, while the websites engaging in One Click Frauds keep a relatively low profile, they are sometimes
hosted on very questionable servers, which essentially turn a blind eye to what their customers are doing.
A possible reason for the relatively lack of conclusive evidence that One Click Frauds sites engage in
other forms of online crime will become clear in the next section, when we look at the potential profits
miscreants can make. Operating a set of One Click Fraud sites is indeed quite a profitable endeavor, and we
conjecture that, engaging in other forms of fraud would only have a marginal benefit to the fraudster, while
increasing the risk of getting caught.
5
Economic incentives
We next turn to looking into the profitability of One Click Frauds. We start by drafting a very simple
economic model, before populating it with the measurements we obtained from our study. The objective is
not to obtain very precise estimates of the actual profits that can be made, but mostly to be able to dimension
the incentives (or disincentives) to engage in One Click Frauds. We first determine the break-even point
in the absence of potential risks for miscreants, before looking at the impact of penalties (prison, fines) on
criminals’ incentives. All the numbers in this section are current as of November 2009.
5.1
Cost-benefit analysis
Costs. A miscreant interested in setting up a One Click Fraud will need a computer and Internet access.
We call this startup cost, Cinit . Cinit is independent of the number of frauds carried out, but is actually
dependent on time, as Internet access is usually provided as a monthly subscription service. Then, the
miscreant will need to purchase a DNS name, possibly joint with a web hosting service. We will call this
cost Chost . This cost, too, is time-dependent.
3
A large number of domains, particularly those reported in 2006–2007, are down, and do not resolve to any IP address anymore.
15
The website has then to be populated with contents (e.g., pornographic images, dating databases), which
will cost Ccont . Ccont can be a fixed price, or a periodic fee, depending on whether the miscreant is purchasing items in bulk, or as part of a syndicated service.
The criminal has to set up a bank account, which should not be traceable back to its real identity. We will
assume the cost of this operation to be Cbank . This is a fixed fee. Likewise, an untraceable phone number
for call-back from the victim may be purchased to make the fraud more successful. We will denote the cost
associated with this purchase Cphone . This fee is likely to be time-dependent; for example, the forwarding
service discussed in Section 4 is a monthly subscription.
Profits. Profits primarily come from money obtained through user payment Puser , conditioned by the
number of users n paying the requested amount f for each incident. The number of users increases with
time. Secondary profits, Presale , may be reaped from reselling databases of victims contact information to
other miscreants.
Utility. As we have discussed before, miscreants may actually set up several frauds, potentially reusing
phone numbers and bank accounts across them. Let us denote by S, K, and B the number of frauds set
up, phone numbers, and bank accounts purchased by a miscreant, respectively. We assume that identical
contents is reused across all frauds operated by the same miscreant, which, based on casual observation,
appears to be the case. We further assume that hosting costs are directly proportional to the number of
sites operated, which is a very conservative assumption, as resellers tend to provide discounts based on the
number of domains purchased. We also assume that the costs of phone and banking services are directly
proportional to the number of phone lines and banking accounts purchased. Finally, because quantifying
Presale is difficult, and is likely to be small in front of the other profits, we simply consider Presale ≥ 0.
Finally, we assume that each fraud has roughly the same probability of being successful, and thus, that the
total number of users to fall for all frauds operated by a miscreant is simply given by multiplying S by n.
With these assumptions, we obtain, for the utility (i.e., the profit or loss miscreants can expect) U , the
following inequality, in absence of any risks linked to being caught:
U (t) ≥ Sn(t)f − Cinit (t)
−S(Chost (t) + Ccont ) − BCbank − KCphone ,
(1)
where t denotes time. Clearly, the policy maker wants U < 0. If, on the other hand, U 0, there is a high
incentive for people to start fraudulent operations.
5.2
Fraud profitability
We next turn to dimensioning each of the parameters in Eqn. (1). We consider t = 1 year in all discussions.
We plot the number of occurrences the most commonly requested amounts of money f are observed
in our database in Fig. 5. The spike at 45,001-50,000 JPY (roughly USD 500) coincides with the average
monthly amount of “pocket money” typical Japanese businessmen are allowed to take from the household
16
Frequency (nr. of frauds)
300
250
200
150
100
50
−3
01
00
1,
30
,0
1−
5,
0
00
35
5,
,0
00
0
0
40 1−4
,0 0,0
01
0
45 −4 0
,0 5,0
01
−5 00
50
0,
,0
00
01
0
−5
55
5,
,0
00
01
0
−6
75
0,
,0
00
01
0
−8
85
0,
,0
00
01
0
−9
95
0
,0
01 ,00
0
−1
00
,0
00
0
Fee amount (in yen)
Figure 5: Ten most common amounts of money requested.
income (45,600 JPY in 2008, [26]).4 The average, over 1,268 records in our database, stands at f =
60, 462 JPY.
Next, the initial cost Cinit combines that of a computer, which the fraudster likely already possesses,
and of an Internet subscription. If the miscreant does not already own a computer, a basic model, around
28,000 JPY (e.g., an Asus EeePC 900X), would be more than sufficient. Likewise, the miscreant probably
already subscribes to an Internet service, but assuming they do not, a modest broadband access is all that
they need. As an example, in 2009, Yahoo! BroadBand provides an ADSL “8 Mbps” plan for 3,904 JPY per
month [8]. We get 0 ≤ Cinit ≤ 74, 848 JPY, where the upper bound is given by assuming a fully dedicated
machine and Internet connection for setting up One Click Frauds, and is obtained combining the prices of
purchasing a new PC and subscribing for one year to the Internet service.
We evaluate Chost using maido3.com, the most popular domain reseller and rental server used by
fraudsters (see Section 4). The Starter Pack Plan costs 3,675 JPY for an initial setup fee; domain registration
and DNS service is free; the plan requires a three months advance payment of 22,050 JPY (monthly fee is
7,350 JPY). We gathered these numbers from our email communication with maido3.com. For a one-year
subscription, we obtain Chost = 91, 875 JPY.
Fraudulent bank accounts can be obtained for prices going between 30,000 and 50,000 JPY [1] from the
black market. As previously mentioned in Section 4, bank accounts are easily forged if created in Internet
banks or banks requiring only postal mail for new contracts since there is no physical interaction during
the contracting process. Also, it is relatively easy to set up fraudulent accounts by taking advantage of
the Japanese writing system. Bank accounts internally use a phonetic alphabet (katakana), different from
the characters used for most names and nouns (kanji). It is thus possible to create ambiguous account
names. For instance, both the “Baking Club of Shirai City” and “Shiraishi Mitsuko” (a person’s name) are
pronounced exactly the same, and thus would have the same account holder information. By registering
as a non-profit organization, the fraudster may easily bypass most identity checks, and subsequently set up
fraudulent transfers using the individual name instead. Creating an account in this fashion would cost much
4
In Japan, the wife of the household typically plays the role of “Chief Financial Officer” and dispenses monthly allowances to
the husband and children.
17
less than 50,000 JPY. We can thus confidently assume Cbank ≤ 50, 000 JPY.
A phone line is required for miscreants to have the ability to further pressure and blackmail the victim
to pay money. Cell phones can be illegally purchased for approximately 35,000 JPY [1, 3], and can be
made untraceable by paying the monthly subscription fees of 7,685 JPY/month [3] at a convenience store,
or by simply using a prepaid phone. Forwarding and anonymizing services discussed in Section 4 can be
purchased for only 840 JPY/month [6]. Assuming all these services are purchased for a year yields an upper
bound Cphone ≤ 137, 300 JPY.
We make the modestly controversial assumption that Ccont = 0. Indeed, we suspect that most of the
pornographic contents presented in One Click Fraud websites is simply copied and plagiarized from other
(non-fraudulent) websites, or obtained through peer-to-peer transfers.
Last, our analysis of Section 4 tells us that, on average, S ≈ 3.7 domains, while B ≈ 5.2 accounts,
and K ≈ 1.3 phone lines. These numbers are obtained by looking at the graph G, and dividing, the total
number of domains operated (481), bank accounts (684), and phone numbers used (176), by the number of
connected subgraphs we found, including singletons (131).
Reusing these numbers in Eqn (1), we obtain a simple linear condition for the fraud to be economically
viable, that is, for U ≥ 0, we need
n ≥ 3.8 users,
to fall for each fraud, within one year. This means that, as long as, for each scam operated, more than
four people fall for the scam within a year, the miscreant turns a profit. In other words, there is an extremely
strong incentive for aspiring criminals to engage in One Click Fraud. This strong incentive is not very
surprising, given the low amount of skills and equipment needed to set up One Click Frauds. What we find
more interesting is how profitable One Click Fraud appears to be.
5.3
Legal aspects
The above incentive assessment ignores the probability of getting caught, and the associated penalties resulting from arrest, which we detail next.
Prosecution probability. Criminals take advantage of social norms and legal loopholes to commit One
Click Frauds. First, most victims do not report these crimes. Indeed, to be able to legally charge a suspect, a
victim must make a formal complaint to the court. Due to the embarrassment associated with the context of
the fraud, many victims do not wish to participate in the accusations that may reveal their identity. Further
complicating matters, is the fact that most DNS resellers and web hosting services used, as we have observed
in our measurements, are physically situated outside of Japan. The part of the fraud infrastructure hosted in
Japan, i.e., the phone line and the bank account, is equally hard to use for investigation. Indeed, police cannot
obtain contact and network information from telecommunication networks unless they have an actual arrest
warrant. Likewise, access to banking accounts is very restricted. Thus, prosecution probability is actually
very low.
18
Date
Location
Damages (×106 JPY)
Victims
Ref.
2/2004 - 4/2005
8/2004 - 8/2005
7/2006 - 4/2007
7/2006 - 11/2007
7/2007 - 8/2008
Osaka
Iwate
Saitama
Chiba
Yamaguchi
600
28
50
300
240
10,000+
450+
700+
3,400+
3,500+
[32]
[37]
[18]
[36]
[10]
Table 5: Press reports of One Click Fraud arrests.
Penalties. In addition, sentences are relatively light. Common fraud (e.g., blackmail), in Japan, carries a
sentence of up to 10 years of imprisonment. However, One Click Frauds very often do not meet the legal
tests necessary for qualifying as “fraud,” as in the vast majority of cases, the victim pays up immediately,
and there is no active blackmailing effort from the miscreant. One could argue that they are nothing more
than a sophisticated form of panhandling. As a result, the few sentences for cases related to One Click Fraud
made public [2] were rather light, with fines ranging from 300,000 JPY to 2,000,000 JPY (≈ USD 3,000 to
20,000) and prison sentences ranging from probation to 2.5 years of jail time.
5.4
Field measurements
We next use field data provided by the Japanese police [14], and compare their findings to ours. Note that
the report [14] combines numbers for One Click Frauds and related confidence scams, so the numbers in
this section are much more approximate than we would wish. However, they remain a useful starting point
to roughly assess the economic impact of these frauds.
Number of frauds per miscreant. First, the police acknowledges, per year, 2,859 cases of frauds leading
to 657 arrests. It is very unlikely that the police would inflate the number of unsolved cases in an external
publication, and it thus appears that each arrested individual was responsible for an average of 4.4 frauds.5
This number is slightly higher than S = 3.7 we found earlier, but the difference is hardly surprising, as the
probability of getting caught increases with the number of sites operated.
Profits made. The Japanese Police estimates, on average, between 2004 and 2008, that 26 billion JPY
per year were swindled in various confidence scams, prominently including One Click Frauds. Dividing
by the number of 2,859 cases the police reports, we find the average income per case to be approximately
9 million JPY over a year (≈ 90,000 USD), a quite staggering number, especially considering that each
arrested individual was responsible for about four cases, potentially making around 360,000 USD. While
we believe that this is likely an over-estimate, due to the unpublished number of unsolved cases, as well as
some potential exaggeration in the losses incurred, profits made by miscreants appear sizable.
5
In Japan, arrests are usually made only when the police is certain with 99% probability or more of the suspect’s guilt. The
conviction rate is thus very high.
19
We can compare this estimate with reports gathered from the press, which we summarize in Table 5.
The profits made appear to be very high, which is not overly surprising considering the number of victims
involved. Recall from the previous section, that one only needs about four victims to break even. Clearly,
with victim numbers in the 450–10,000 range, we can expect very significant profits, which, in Table 5 are
estimated between approximately USD 28,000 and 600,000 for each group arrested. Thus, the USD 90,000
– 360,000 estimate acquired from the police reports seems to be in the right order of magnitude.
Ironically, the case reported in [37] names the suspect as a famous IT writer specializing in cybercrime
and appearing in multiple TV programs to warn the public of the dangers of One Click Fraud. One cannot
help but think that the suspect, being very familiar with the inner workings of One Click Fraud, must have
reached a conclusion identical to that of the present paper, that is, that there is a significant economic
advantage to engage in such frauds.
We also note that these arrests were likely possible by the sheer magnitude of the fraud. A criminal
confining themselves to only a few dozens victims would likely be able to make a reasonable profit, while
being extremely hard to catch.
6
Discussion and conclusions
This paper attempts to provide a comprehensive picture of a confidence scam used in Japan, called One
Click Fraud. By gathering over 2,000 reports of incidents from vigilante websites, we were able to describe
a number of potential vulnerabilities that miscreants use (lax registration checks, resellers turning a blind
eye to their customers’ activities), and also showed that the market appears to be quite heavily concentrated.
The top eight miscreant groups are responsible for more than half the frauds we uncovered. At the same
time, a large number of individuals seem to be participating in frauds of smaller magnitude.
We showed that an important reason for these scams to flourish is the strong economic incentives miscreants have. They can break even as soon as they manage to successfully scam four victims for each fraud,
and, on average can make profits in the order of USD 10,000-100,000 or more per year. Prosecution is
difficult, since victims are reluctant to come forward, and the penalties that can be meted are relatively light.
Reforming the law to impose harsher penalties is not easy, as proving the mere existence of a crime
is cumbersome. On the other hand, prevention, identification, and take-down seems more feasible. Our
study shows that identifying perpetrators can greatly benefit from a bird’s eye view of the network. In our
discussions with the police, we learned that different cases are usually assigned to separate officers, and that
communication could be greatly improved. For instance, one officer may investigate a fraudulent phone
number, while another may be investigating an online fraud. If the phone number is used in said fraud,
clearly both officers would benefit from sharing the results of their investigations. However, such holistic
approaches remain relatively rare in practice.
Future work. We believe that, while we tried to provide as comprehensive a study as possible, we could
enrich the data we obtained by looking for connections with other forms of crime in more details. Our
conclusions, thus far, are that domains involved in One Click Fraud do not apparently engage in other forms
of fraud. However, these results are only based on a relatively simple check of known blacklists. Studying
20
in more details WHOIS registrations cross-listings, as well as possible connections with more “mainstream”
pornographic sites could reveal further insights.
Also, an article issued at the time of this writing [9] shows that One Click Fraud is now using peer-to-peer
software as a propagation vector for viruses very similar to Trojan.HachiLem. While the propagation
method is new, the psychological factors making such scams successful remain the same. Finding how to
address these psychological traits is a promising area of research, quite related to ongoing works in security
psychology [27].
We have also observed, in the police records that we eventually were not able to use, that 71 out of 359
scams reported were SMS-based. That is, One Click Frauds are also affecting mobile websites. Whether the
perpetrators are the same, or different groups, remains unknown, and would warrant further investigation.
Despite being focused on a very specific crime, we believe that some of the methodology we used in
this paper (graph-theory based modeling, and clustering techniques, for example) could very well apply to
other forms of online frauds. As mentioned in the introduction, One Click Frauds are closely related to the
more general body of scareware scams, and some of the techniques we use could equally apply to analyzing
scareware markets. More generally, we hope this paper will help facilitate an ambitious research agenda to
gather more data from online criminal activities. An improved understanding of the economics of online
crime is indeed essential in determining which policies may work to curb the problem.
7
Acknowledgments
This research benefited from many discussions with Kilho Shin, Jens Grossklags, and with our colleagues
at Carnegie Mellon CyLab, both at CyLab Japan and in Pittsburgh. The Hyogo Prefecture Police was
instrumental in availing to us the case data used in Section 5. Ashwini Rao and Lirida Kercelli helped with
some of the DNS black-listing tests. Sachi Iwata-Christin provided additional translation assistance.
References
[1] Black market yamamoto web. In Japanese. http://yamashita0721.web.fc2.com. Last accessed April
16, 2010.
[2] Koguma-neko teikoku. http://www.kogumaneko.tk.
[3] Manual on how to live anonymously. In Japanese. http://homepage3.nifty.com/nonu/tokumei1.
html. Last accessed April 16, 2010.
[4] MeCab: Yet another part-of-speech and morphological analyzer. http://mecab.sourceforge.net.
[5] Ni-channeru (Channel two). http://www.2ch.net.
[6] Symphonet Services Co. In Japanese. http://symphonet.co.jp. Last accessed April 16, 2010.
[7] Wan-cli zukan. http://zukan.269g.net/.
[8] Yahoo! BB ADSL. http://bbpromo.yahoo.co.jp/adsl/type2/index.html. Last accessed April
16, 2010.
21
[9] BBC News. Porn virus publishes web history of victims on the net. http://news.bbc.co.uk/2/hi/
technology/8622665.stm. Published April 15, 2010. Last accessed April 16, 2010.
[10] Chugoku Shimbun. Arrested for one click fraud. August 16, 2008. http://www.chugoku-np.co.jp/
News/Tn200808160061.html. Last accessed November 21, 2009.
[11] Electronic Frontier Foundation. Panopticlick, 2009. Available at https://panopticlick.eff.org/.
Last accessed April 10, 2010.
[12] J. Franklin, V. Paxson, A. Perrig, and S. Savage. An inquiry into the nature and causes of the wealth of internet
miscreants. In Proceedings of 14th ACM Conference on Computer and Communications Security (CCS), pages
375–388, Alexandria, VA, October 2007.
[13] C. Herley and D. Florêncio. Nobody sells gold for the price of silver: Dishonesty, uncertainty and the underground economy. In Proceedings (online) of the Worskshop on Economics of Information Security, June 2009.
Available from http://weis09.infosecon.net/.
[14] Japan National Police Agency. Incident report and monetary damanges of direct deposit frauds, 2009.
Archived at http://megalodon.jp/2010-0223-1659-40/www.npa.go.jp/safetylife/
seianki31/1_hurikome.files/Page386.htm. Last accessed April 16, 2010. In Japanese.
[15] Japanese Information Technology Promotion Agency. Virus detection reports, October 2009. In Japanese.
http://www.ipa.go.jp/security/txt/2009/10outline.html. Last accessed April 20, 1010.
[16] C. Kanich, C. Kreibich, K. Levchenko, B. Enright, G. Voelker, V. Paxson, and S. Savage. Spamalytics: An
empirical analysis of spam marketing conversion. In Proceedings of the Conference on Computer and Communications Security (CCS), Alexandria, VA, October 2008.
[17] N. Kato and T. Kawabata. The advance of the fraudulent business scheme through the it and the legal measures of specified business transaction. In Proceedings of the AIEEJ Media Computing Conference, 2007.
In Japanese. Abstract available online at http://www.jstage.jst.go.jp/browse/aiieej/35/0/
_contents/-char/ja/. Last accessed April 10, 2010.
[18] Mainichi Shimbun. Fraud: Suspect arrested again for requiring a registration fee for unauthorized access. March
4, 2007. http://blog.goo.ne.jp/alladult/e/4a53e012de3c0335a838d99161e9d8bc. Last
accessed April 16, 2010.
[19] Ministry of Justice, Japan.
Act on special provisions to the civil code concerning electronic consumer contracts and electronic acceptance notice.
English translation accessible online at http:
//www.japaneselawtranslation.go.jp/law/detail/?yo=&ft=2re=01&ky=&page=3. Last
accessed April 10, 2010.
[20] T. Moore and R. Clayton. Examining the impact of website take-down on phishing. In Proceedings of the Second
APWG eCrime Researcher’s Summit, Pittsburgh, PA, October 2007.
[21] T. Moore and R. Clayton. Evil searching: Compromise and recompromise of internet hosts for phishing. In 13th
International Conference on Financial Cryptography and Data Security, Barbados, February 2009.
[22] T. Moore, R. Clayton, and R. Anderson. The economics of online crime. Journal of Economic Perspectives,
23(3):3–20, Summer 2009.
[23] T. Moore, R. Clayton, and H. Stern. Temporal correlations between spam and phishing websites. In 2nd USENIX
Workshop on Large-Scale Exploits and Emergent Threats (LEET ’09), Boston, MA, April 2009.
22
[24] T. Moore and B. Edelman. Measuring the perpetrators and funders of typosquatting. In Proceedings of the 2010
Financial Cryptography Conference (FC’10), Canary Islands, Spain, January 2010.
[25] N. Provos, P. Mavrommatis, M. Rajab, and F. Monrose. All your iFrames point to us. In Proceedings of the 17th
USENIX Security Symposium, August 2008.
[26] Shinsei Financial.
Japanese businessmen monthly allowance, 2009.
In Japanese. http://www.
shinseifinancial.co.jp/aboutus/questionnaire/kozukai2009/. Last accessed April 16,
2010.
[27] F. Stajano and P. Wilson. Understanding scam victims: Seven principles for systems security. Technical Report
UCAM-CL-TR-754, Cambridge University, August 2009. To appear in Communications of the ACM.
[28] B. Stone-Gross, M. Cova, L. Cavallaro, B. Gilbert, M. Szydlowski, R. Kemmerer, C. Kruegel, and G. Vigna.
Your botnet is my botnet: analysis of a botnet takeover. In Proceedings of ACM CCS’09, Chicago, IL, October
2009.
[29] P. Swire. No Cop on the Beat: Underenforcement in E-Commerce and Cybercrime. Journal on Telecommunications and High Technology Law, forthcoming 2008.
[30] R. Thomas and J. Martin. The underground economy: Priceless. ;login:, 31(6):7–16, December 2006.
[31] Tokyo Metropolitan Police Association. Stop frivolous billing requests! In Japanese. http://www.anzen.
metro.tokyo.jp/net/attention.html. Last accessed April 15, 2010.
[32] Tokyo Shimbun. First arrest for one click fraud, 5 individuals arrested, website owner issued a warrant of arrest,
victims said to exceed 1,000 and monetary damages of up to 600 million yen. April 13, 2005. http://www6.
big.or.jp/˜beyond/akutoku/news/2005/0413-10.html. Last accessed April 16, 2010.
[33] Toyo Keizai Inc. Quarterly Corporate Report Sector Map 2010. 2009.
[34] Webhosting.Info. Largest ICANN registrars, November 2009.
registrars/top-registrars/global/.
http://www.webhosting.info/
[35] G. Wondracek, T. Holz, C. Platzer, E. Kirda, and C. Kruegel. Is the internet for porn? An insight into the online
adult industry. In Proceedings (online) of the 9th Workshop on Economics of Information Security, Cambridge,
MA, June 2010.
[36] Yomiuri Shimbun. Company president arrested for two click fraud. November 28, 2007. http://www.
yomiuri.co.jp/net/security/s-news/20071128nt0c.htm. Last accessed April 16, 2010.
[37] Yomiuri Shimbun. IT writer arrested. November 8, 2005. http://www.yomiuri.co.jp/net/news/
20051108nt03.htm. Last accessed April 16, 2010.
[38] J. Zhuge, T. Holz, C. Song, J. Guo, X. Han, and W. Zou. Studying malicious websites and the underground
economy on the Chinese web. In Proceedings (online) of the Seventh Workshop on the Economics of Information
Security (WEIS), Hanover, NH, June 2008.
23