Dissecting One Click Frauds∗

Nicolas Christin Sally S. Yanagihara Keisuke Kamataki Carnegie Mellon Carnegie Mellon Carnegie Mellon INI/CyLab INI/CyLab Japan LTI/CS [email protected] [email protected] [email protected]

Carnegie Mellon University Technical Report CMU-CyLab-10-011 April 23, 2010

Abstract “One Click Fraud” is an online conﬁdence scam that has been plaguing an increasing number of Japanese Internet users, in spite of new laws and the mobilization of police task forces. In this scam, the victim clicks on a link presented to them, only to be informed that they just entered a binding contract and are required to pay a registration fee for a service. Even though no money is legally owed, a large number of users prefer to pay up, because of potential embarrassment due to the type of service “requested” (e.g., pornographic goods). Using public reports of fraudulent websites as a source of data, we analyze over 2,000 reported One Click Frauds incidents. By correlating several attributes (WHOIS data, bank accounts, phone numbers, malware installed...), we discover that a few fraudsters are seemingly responsible for a majority of the scams, and evidence a number of loopholes these miscreants exploit. We further show that, while some of these sites may also be engaging in other illicit activities such as spamming, the connection between different types of scams is much more tenuous than expected. Last, we show that the rise in the number of these frauds is fueled by high expected monetary gains in return for very little risk. The quantitative data obtained gives us an interesting window on the economic dynamics of some online criminal syndicates. Keywords: Security Economics, Measurements, Web Frauds, Online Crime

∗This research was supported in part by CyLab at Carnegie Mellon under grant DAAD19-02-1-0389 from the Army Research Ofﬁce, and by the National Science Foundation under ITR award CCF-0424422 (TRUST). 1 Introduction

In the family apartment in Tokyo, Ken is sitting at his computer, casually browsing the free section of a mildly erotic website. Suddenly, a window pops up, telling him,

Thank you for your patronage! You successfully registered for our premium online services, at an incredible price of 50,000 JPY.1 Please promptly send your payment by bank transfer to ABC Ltd at Ginko Bank, Account 1234567. Questions? Please contact us at 080-1234-1234. Your IP address is 10.1.2.3, you run Firefox 3.5 over Windows XP, and you are connecting from Tokyo. Failure to send your payment promptly will force us to mail you a postcard reminder to your home address. Customers refusing to pay will be prosecuted to the fullest extent of the law. Once again, thank you for your patronage!

A sample postcard reminder is shown on the screen, and consists of a scantily clad woman in a provocative pose. Ken has a sudden panic attack: He is married, and, if his wife were to find out about his browsing habits, his marriage would be in trouble, possibly ending in divorce, and public shame. In his frenzied state of mind, Ken also fears that, if anybody at his company heard about this, he could possibly lose his job. Obviously, those website operators know who he is and where he lives, and could make his life very difficult. Now, 50,000 JPY (≈ USD 500) seems like a small price to pay to make all of this go away. Ken immediately jots down the contact information, goes to the nearest bank, and acquits himself of his supposed debt. Ken has just been the victim of a relatively common online scam perpetrated in Japan, called “One Click Fraud.” In this fraud, the “customer,” i.e., the victim, does not enter any legally binding agreement, and the perpetrators only have marginal information about the client that connected to their website (IP address, User-Agent string), which does not reveal much about the user.2 However, facing a display of authority stressed by the language used, including the notion that they are monitored, and a sense of shame from browsing sites with questionable contents, most victims do not realize they are part of an extortion scam. Some victims even call up the phone numbers provided, and, in hopes of resolving the situation, disclose private information, such as name or address, to their tormentors, which makes them even more vulnerable to blackmail. As a result, One Click Frauds have been very successful in Japan. Annual police reports show that the estimated amount of monetary damages stemming from One Click Frauds and related confidence scams are roughly 26 billion JPY per year (i.e., USD 260 million/year). The rapid rise of such frauds has led to new laws being passed [17,19], to the deployment of police task forces specifically put in charge of solving these frauds, and to specialized help desks [15]. On the other hand, there have been so far, on average only 657 arrests and 2,859 solved cases per year [14]. Considering the lack of technical sophistication needed to set up such extortion schemes, and the fact that bank accounts and phone numbers can be made very hard

1100 JPY≈ 1 USD. 2The Panopticlick project [11] aims to show that browser ﬁngerprints can divulge considerable information about the user. However, none of the One Click Fraud websites we investigated appears to use any advanced browser ﬁngerprinting techniques.

2 to trace in Japan (discussed in Section 5), it appears that One Click Frauds offer easy money to aspiring criminals. From a research point of view, One Click Frauds offer a unique opportunity for a case study in online crime economics. First, One Click Frauds, are extremely localized. We have not seen any instance of this specific fraud outside of Japan, presumably due to the fact that the scammers prey on unique Japanese cultural characteristics, such as respect of authority, or embarrassment at the idea of causing trouble. Rather than limiting our research, we view this local aspect as an opportunity. Indeed, because One Click Frauds are contained to Japan, and are almost exclusively used in Japanese-language websites, we can obtain a relatively exhaustive view of how these frauds are deployed and the characteristics they share, without the need for a complex measurement infrastructure. Furthermore, One Click Frauds, albeit unique, are very closely related to the body of scareware scams (e.g., windows popping up trying to entice users to buy fake anti-virus software) that are becoming increasingly pervasive, and we believe One Click Frauds offer an interesting window in this type of criminal enterprise. The first contribution of this paper is to collect and analyze a corpus of over 2,000 reported One Click Fraud incidents, and to use the data collected to paint a relatively clear picture of the economic dynamics of an instance of online criminal activity. Specifically, we set out to answer the following questions: Who is committing these frauds? Are One Click Frauds the product of organized criminal activities, or are they more artisanal in nature, with many aspiring crooks trying their luck? How much do criminals stand to gain? Are there vulnerabilities in the network infrastructure (e.g., weak registration processes, easy access to compromised accounts, etc...) that are easily exploited by the miscreants? In the process of finding answers to these questions, a second important contribution of our paper is to provide monetary amounts, which help dimension the size of the One Click Fraud market, and the profits potentially made. While economic modeling of cybercrime has been an increasingly active research topic (see for instance [12,16,22,24,35]), we believe that obtaining additional measurements and clearly detailing the methodology we employ should help enrich our knowledge of how online criminal syndicates operate, while assuaging concerns on the validity of the estimates formulated [13]. Furthermore, some of the measurement methodology we employ is likely to be applicable beyond the context of One Click Frauds. Third, our analysis methodology can be helpful to law enforcement agencies. Law enforcement typically assigns different fraud instances to specific agents, who mostly operate independently of each other. However, we show that, by analyzing a relatively large dataset of frauds, we can extract characteristics that are not visible when considering smaller subsets of these frauds. These characteristics can in turn be useful to law enforcement in identifying, and perhaps prosecuting, the miscreants behind these crimes [29]. The rest of this paper is organized as follows. We review the related work in Section 2. We then explain our data collection methodology in Section 3. We turn to analyzing the data collected in Section 4. We use this analysis to study economic incentives for the perpetrators in Section 5, before discussing the implications of our study, and drawing brief conclusions in Section 6.

3 2 Related work

Moore et al. contend that online crime has become economically significant since around 2004 [22]. Hence, research in measuring the economic impact of online crime is a relatively recent field, but a number of papers on the topic have been published in the past couple of years. We present several important advances in the field in this section, and refer the reader to Moore et al. [22] for a more exhaustive treatment of the literature. Some of the pioneering work in the field has tried to quantify the value of fraudulent financial credentials as well as that of compromised hosts (“bots”), through passive observations. In particular, Thomas and Martin [30], and Franklin et al. [12] monitored IRC channels where miscreants attempt to sell commodities as diverse as stolen credit card numbers, bank account credentials, or email databases for spam, to obtain estimates of the value of these items as well as the volumes of the market associated with exchanges of such goods. Along the same lines, Zhuge et al. [38] describe how criminals operate in Chinese underground markets, and provide some insight regarding some of the goods exchanged in these markets by monitoring web forums where such items are advertised; a particularly popular item appears to be forged or stolen online video game currency. Passive monitoring, as discussed above, has been criticized for only measuring advertised prices, as opposed to actual realized sales [13]. A more recent line of research addresses this concern by actively participating in the online exchanges, by essentially “hijacking” some of the infrastructure used by miscreants. Kanich et al. [16] infiltrate a large botnet, and modify some of the spam traffic generated by the botnet to redirect purchases to a server under their control, thereby acquiring data on spam conversion rates. The key insight is that 350 million spam messages sent result in 28 sales. In other words, spamming is highly ineffective, but, considering its cost is negligible, and that bots can be used to generate other forms of profit (e.g., phishing site hosting), it remains a relatively popular form of crime. A similar botnet take-over is described in Stone-Gross et al. [28], who monitor the type of services supported by the Torpig botnet. In a similar vein, Wondracek et al. [35] focus on the economics of the distribution of pornographic materials, by covertly operating an adult web server. Perhaps closer in spirit to the methodology we employ in this paper, a significant body of literature [20,21,23] is devoted to quantifying the economic impact of phishing scams, as well as the modus operandi of the attackers. One of the main outcomes of this line of research is to evidence that a large proportion of phishing activities are carried out by a modest number of phishing gangs, who use relatively sophisticated “fast-flux” techniques, where phishing sites are used as disposable commodities hosted on compromised hosts. This body of research puts the number of phishing websites at around 116,000. Likewise, Moore and Edelman [24] gather a large corpus of data on typosquatting domains, to quantify the economic value of such sites, as well as potential disincentives for advertisement networks to intervene forcefully. Finally, Provos et al. [25] provide a comprehensive overview of web-based malware distribution, showing that there are in excess of 3 million web pages attempting to infect their visitors. The work we present here is complementary to the existing literature. To our knowledge, this is the first time One Click Frauds are analyzed from a quantitative and technical perspective. (Research on the legal

4 ramiﬁcations and countermeasures, on the other hand, has been active [17].) More generally, we focus on a relatively contained instance of a scam, and attempt to gather both economic data (potential revenue, deployment costs to the perpetrators...) and structural data (number of players, relationships between players, ...) through a systematic measurement methodology, which we believe can be useful beyond the study of this speciﬁc fraud.

3 Data collection

To ﬁnd instances of One Click Frauds, we rely on public forums which report fraud incidents, along with details regarding the website being used, the amount of money extorted, as well as fraudster contact information (bank account number, phone number, ...). We collect data from three public forums: 2 Channel BBS [5]: The largest bulletin board in Japan, which provides discussion threads on various topics ranging from Japanese anime to sports. Several ongoing threads are dedicated to denouncing One Click Frauds. Koguma-neko Teikoku [2]: Privately owned website providing help to solve consumer problems related with online activities. A section of the site is devoted to describing One Click Frauds, including information about scam incidents. Wan-Cli Zukan [7]: Privately owned website solely devoted to exposing websites partaking in One Click Frauds.

Collection methodology. We gather data posted on the three websites we polled over a period of roughly three years (2006-2009). Specifically, we collect 2 Channel posts made between March 6, 2006 and October 26, 2009, Koguma-neko Teikoku posts made between August 24, 2006 and August 14, 2009, and Wan-Cli Zukan posts made between September 6, 2006 and October 26, 2009. All in all, we gathered 2,140 incident reports. While it is difficult to determine how exhaustive our data collection is compared to the total number of frauds perpetrated, we note that there is a significant overlap in the data provided by all three sites, which indicates we probably captured the most successful frauds, and that our coverage is likely adequate. Initially, we also tried to extract information from data provided by the Japanese police [31]. Unfortu- nately, these reports are in image format, and do not contain much actionable information, even after using optical character recognition. Indeed, most of the interesting details (e.g., bank account used) are often not divulged.

Data parsing. The three sites present marked differences. 2 Channel is based on anonymous postings from various users who have encountered a One Click Fraud website and post notifications to other users. Due to its popularity and large user base, 2 Channel contains a wealth of information. However, because 2 Channel threads are essentially an open discussion, parsing the data for useful input is challenging. Koguma-neko Teikoku is also a collaborative web space, but, different from 2 Channel, Koguma-neko Teikoku requires posters to input information about One Click Frauds in a specified format. Finally, Wan-Cli Zukan is closer to a blog, where the website owner periodically posts notifications in a fixed format. Outsiders cannot directly post to the site.

5 Parsing the data from Wan-Cli Zukan and Koguma-neko Teikoku is straightforward, as both sites use a predetermined format for all posts relevant to One Click Frauds. Likewise, the data is of high quality. Randomly sampling the reported sites, we did not ﬁnd a single instance of slander – i.e., benign sites which would be reported as fraudulent. Either the sites reported were, indeed, hosting One Click Frauds, or they had been recently taken down.

Figure 1: Example of 2 Channel posting. The lack of structure makes parsing slightly complex. Here, usable information is only contained in the squared area; oftentimes, formatting is even more haphazard.

On the other hand, 2 Channel is considerably more challenging to use. An example of 2 Channel posting is shown in Fig. 1. Since the data is not formatted according to a speciﬁc standard, we have to perform some basic text segmentation. Adding to the difﬁculty, is the fact that the Japanese language has comparatively few punctuation rules. For instance, words are rarely separated by spaces, there is no capitalization, and most characters have a couple of different readings depending on the context. Furthermore, in forums like 2 Channel, specialized slang and abbreviations are the norm, rather than the exception. To perform text extraction, we use the MeCab parser and data analyzer [4]. MeCab extracts Japanese characters into semantic units. This allows us to obtain a list of tokens, such as “ginko” (bank), “Sumitomo” (name), “hutsuu” (usual), “1234567.” We can then perform context-dependent parsing. The previous series of token tells us that it is highly likely that the poster talks about a “usual” checking account number 1234567 and Sumitomo bank.

6 Data source N. records 2 Channel 1077 Unambiguous, w/ URL 353 Unambiguous, w/o URL 174 Ambiguous, w/ URL 218 Ambiguous, w/o URL 332 Koguma-neko 372 Unambiguous, w/ URL 2 Ambiguous, w/ URL 362 Ambiguous, w/o URL 8 Wan-Cli Zukan 691 Unambiguous, w/ URL 632 Unambiguous, w/o URL 59

Table 1: Number of extracted fraud incidents from each source.

Despite the added difﬁculty of parsing 2 Channel threads, we did not encounter any erroneous or libel- lous postings. While a certain level of verbal abuse is present in such an unmoderated forum, it is easily separated from relevant information, once text segmentation is performed.

Extracted attributes. For all three sources of data, after having parsed and cleaned the input, we extract the following attributes: URL of the fraudulent website; Bank account number given by the fraudster for remittance of funds; Bank name; Branch name; Account holder name; Contact phone number; Registration fee requested (i.e., amount of the fraud). Some of these attributes (e.g., account holder name) are probably fake. However, for the fraudsters to be able to receive money, the financial information has to be genuine. Likewise, contact information (email and phone numbers), when present, is usually accurate, as miscreants provide the victims with a way of “calling back” to further their social engineering attacks. Table 1 describes the number of fraud incidents that we extracted from each of the three sources of data. Note that, these sources are not mutually exclusive. In fact, we have significant overlap between the different sources. Second, the raw data that we extract needs to be cleaned up significantly. A number of records are incomplete to some extent (missing phone number for example); out of these incomplete records, particularly problematic are records that do not contain a URL field, as the existence of a fraud cannot be verified. In addition, a number of records are ambiguous in that some fields have more than one entry. For instance, a given post may contain one URL but several phone numbers. Most of these records need to be scrutinized manually, to check whether parsing was done correctly and whether the record indeed contains several fields. All results are stored in a MySQL database. We illustrate a typical entry in our database in Table 2. To help make our experiments reproducible, we make a copy of a dump of our database available (in gzip’ed

7 form) at http://arima.ini.cmu.edu/public/oneclick.sql.gz. After having cleaned up our original dataset, we use the extracted URL to infer the domain hosting the fraud, and, whenever possible, to obtain registrar (“WHOIS”) information. We also periodically download the corresponding website (using wget in recursive mode) to check for potential changes indicating a take- down, and to check for the presence of malware on the fraudulent site. Note that, due to the time interval (three years) over which incident reports we collect were reported, a signiﬁcant amount of data points to sites that have long been taken down. Thus, a number of records are hard to verify and may be missing information. For example, we have a smaller number of entries with valid DNS domain information, compared to the number of incidents reported.

ID Date posted URL 370 2007-02-03 00:00:00 http://www.331164.com/ IP Email Bank 69.64.155.122 [email protected] Sumitomo Mitsui Branch Acct. Type Acct. Number Koenji Checking 7184701 Acct. Holder Phone # Fee Takahashi, Mizuki 080-5182-7956 JPY 88,000

Table 2: Example of database entry. Note that not all attributes can always be extracted.

4 Data analysis

We next turn to analyzing the relatively large corpus of One Click Frauds we gathered. Speciﬁcally, we seek loopholes in the infrastructure that attackers are able to exploit. We then try to assess some of the characteristics of the online criminal market behind One Click Frauds, and in particular, investigate whether some miscreants are responsible for several frauds. Last, we try to determine whether fraudsters engage in other illicit activities beyond One Click Fraud.

4.1 Infrastructural loopholes

We start by checking our data corpus for evidence of repeating patterns in the attributes we collected. The idea is that, departures from usual patterns may indicate evidence of vulnerabilities in the infrastructure. If, for instance, a disproportionate number of frauds uses bank accounts at Bank X, one can reasonably infer that Bank X processes for identity verification and account establishment are flawed. We first consider the phone numbers used by fraudsters. We are able to identify the phone number used for callback in 516 separate incidents. We check the phone numbers in our database against the phone number ownership list published by the Japanese Ministry of Internal Affairs and Communications. We find that 38.6% of the phone numbers used in One Click Frauds are au cellular lines, 23.3% are Softbank cellular lines, and 16.5% are local landlines for the Tokyo area. A 2009 report about the Japanese cellular phone

8 Registrar Prop. of frauds Registrar Market share [34] ENom 47.56% Go Daddy 29.08% GMO Internet 17.48% ENom 8.30% Above 5.14% Tucows 6.82% Go Daddy 4.11% Network 6.06% Tucows 3.34% Solutions Key Systems 2.83% Schlund + Partners 4.38% New Dream Network 1.54% Melbourne IT 4.34% Abdomainations 1.29% Wild West Domains 2.89% All Earth Domains 1.03% Moniker 2.43% Dotster 1.03% Register.com 2.40% Moniker 1.03% Public Domain Registry 2.17% OTHER 13.62%

Table 3: Registrars used in One Click Frauds. The left table shows the market share of the 10 most popular registrars (and thus does not sum to 100%). The bottom right shows the 11 most frequently used registrars in One Click Frauds, along with the respective proportion of frauds they host. Numbers are obtained out of the 389 fraudulent domains for which WHOIS information was accessible. market [33, pp. 78–79], tells us that au has about 25% of the market share, while NTT Docomo represents about 50% of the market. So, it appears as though au cellular lines are disproportionately targeted by fraudsters. Whether this is due to lax registration practices, or to easier access to compromised lines, is unclear. The large proportion of Tokyo numbers may be explained not only by the amount of population in that area, but also by the fact that most forwarding services, which redirect all incoming calls to a different number while preserving the anonymity of the callee, use Tokyo numbers. Next, we identify the bank used in 803 separate incidents. We observe that online banks tend to be slightly more represented in these frauds than their actual market share should warrant. For example, 116 frauds (14.44%) use the online Seven Bank. On the other hand, this bank does not have a signiﬁcant market share in Japan [33, pp. 82–83]. eBank and JapanNet Bank are two other examples of online banks used at a notable level (around 3%) in One Click Frauds, while holding only a small market share. A possible explanation is that online banks do not require a physical interaction to let individuals open an account, and are thus potentially more prone to abusive registrations. We observe even more interesting patterns, when we look at DNS registrars and resellers that are abused by fraudsters. Table 3 compares the market share, as of Nov. 2009, of the top domain name registrars [34] with the proportion of registrars used by domain names participating in One Click Frauds. We are able to identify the registrars used in 389 incidents. We note that ENom is apparently much more victim of abuse than other top domain name registrars. Likewise, Above and GMO Internet rank highly with fraudsters, while not having signiﬁcant market share. This result can indicate one of two possibilities: Either these registrars have very lenient registration policies, or they entrust some of their domains to resellers that are

9 40

30 maido3.com 25

20 value−domain.com

15 dreamhost.com

10 mixedmedia.net Number of websites hosted

5 free−passmovie.com dnsvx.jp trellian.com80code.com 0

Figure 2: Number of websites hosted by the resellers used in more than one incident.

not perfectly scrupulous. To find out which domain name resellers are used, we examine the DNS field in the WHOIS record associated with the domain used in each One Click Fraud. A large number of sites we investigate have been taken down (particularly those obtained from 2006-2007 sources). In some cases, though, the One Click Fraud sites have been replaced by domain parking pages, and thus still have valid WHOIS information, which may reveal information on the reseller used. Another large number of sites use either their own DNS server, or free DNS services like opendns.com, and are thus discarded from analysis. We complement investigation of the WHOIS DNS fields with a simple reverse DNS/DNS lookup script. For instance: dig +short admovie69.com | xargs dig +short -x yields ikero.dreamhost.com, which tells us the web hosting service is dreamhost.com. We eventually manage to identify the resellers in 97 incidents. In Figure 2, we graph the number of at resellers that are used in more than one incident. We note that, for our successful lookups, a couple of resellers (maido3.com, value-domain.com, ...) appear to be highly represented. They tend to be cheap resellers, with lax, or absent registration checks. Specifically, we investigated further maido3.com. We used a disposable email address to request rental of a specific domain name and server space. We used a fake name, address and phone number, which could have been easily spotted, as the address was that of a famous subway station. We received an immediate response with invoicing details. A simple money transfer was all that was needed; and this could be performed anonymously by using cash at a convenience store. The reseller promised the site would be up within 30 minutes of the payment being sent. No identity checks were ever performed. In other words, this specific reseller can be easily abused for fraudulent activities. While we have not attempted the same type of test with the other “popular” resellers, we venture to guess that their registration processed are likely easily abused as well.

10 4.2 Grouping miscreants

We next attempt to determine whether we can ﬁnd evidence of organized criminal activities through miscreant behavior. In this paper, we qualify by “organized criminal activity” large scale operations involving many frauds, using a considerable number of bank accounts and stolen or abused phone lines, and possibly coordinating with other organizations to deploy malware or share stolen information. We contrast such large scale operations with those involving only a couple of sites.

Methodology. We deﬁne an undirected graph G = (V,E) as follows. We create a vertex v ∈ V for each domain name, bank account number, or phone number our database contains. Then, we connect vertices belonging to the same fraud with edges E. For instance, if our database contains an entry for a fraud hosted on example.com, with bank account number 1234567 and phone number 080-1234-1234, we add

(v1, v2, v3) = { example.com, 1234567, 080 − 1234 − 1234} to V , and three edges (e1, e2, e3) = {v1 ↔ v2, v1 ↔ v3, v2 ↔ v3} to E. Note that, by building the graph G in this fashion, two nodes of the same type (domain name, bank account number, phone number) never link directly to each other, but can be connected through an intermediary. For example, two websites using the same phone number result in a connected path between the three concerned nodes. One natural question is why we chose not to link two different domain names pointing to the same IP address. The reason is, that we realized that this happened sometimes for sites that were markedly different, only because they were co-hosted on the same machine by a common reseller. In other words, both incidents shared the same web hosting provider, but were not related otherwise. We decided to err on the side of caution, and not to consider identical IP addresses as a strong indicator of identical ownership. Parsing the entire database yields a graph with 1,341 nodes and 5,296 edges. We first isolate 26 “singletons” representing connected subgraphs containing at most three nodes, and at most one domain name, one phone number and one bank account. These singletons represent incidents that we cannot connect to any other fraud. All “one-off” scams fall in this category. Excluding the 26 singletons, the whole graph G contains 105 connected subgraphs (“clusters”), with sizes ranging from a couple of nodes and edges to a large cluster containing 179 nodes (56 domains, 112 bank accounts, 11 phone numbers), and 696 edges. We plot the graph G in Fig. 3. While the specific domain names, phone numbers, and bank account numbers are not readable at this scale, we can clearly distinguish the connected subgraphs, which are ordered in separate boxes in the figure. The presence of large connected subgraphs (e.g., top right) indicates that some miscreants are operating a large number of sites, and are reusing phone numbers or bank accounts across several sites. While it could, in theory, be possible that two completely different criminals share an identical bank account number, we reject this hypothesis, as the bank account numbers used have to be valid for the criminals to collect their dues. Hence, a shared bank account number means that, at the very least, the miscreants sharing the account are in a tight business relationship, and probably are the same individual or group of individuals. Likewise, because phone numbers used in these frauds are genuine, reusing the same phone number across several frauds indicates a business relationship between the perpetrators.

11 angel−blog.jp

franky−tube.com

0352183

441583 0414092

cutieluv.net 0331261 5329658

08011594469 0363802956 0225110 himawari−blog.com 1619457

7160136 0792520388 hanabi−don.com 1641074 bukkakex.net

1470805 8860037 0386661

1078564 0358519965 moon−a.com

8842125 a−milk.net

09091503831 1953945

5317013 1657050 nip−go.net

ad−hole.com 1209448 bubble−gum.jp

6311731

0894719 2037698 jannie.jp 1611762

204246 357089 beguru.jp subi−ing.com little−ag.com 3956232 7595857 1351803

movie−love.com juku−juku.com sexy2.jp

1340013 cha−nel.jp 374480 0358519962 0332860 tirallin.com bubuko.jp

alsoira−p.com 1637788

1391139 a−file.net 5333906 a−vivi.net coro56.com 1494273 5092915 3156739 tv−adult.net 0120555061 meron−pan.com 1194160 pyuride.com 347670 1638224 4099066 avclinic.net 7019885 best−mov.com cinderella−movie.com nurenuremanko.com hateblog.jp 3779326 0351715 346902 idol−douga.jp 08031241652 1999395 3161820 4041614 1675648 216072 08065323977 0330248 1426302 info.net mermaid−haisin.com 0358519964 adult−collection09.net 1078676 0358519961 09088123505 7810164 08011659432 5329569 341687 0349541 grin−2.com 1418160 4044113 0120540940 0157663 4032599 7696035 5328716 370195 adult−dream.net 0340035 cheezu.net gal−star.com

adult−player.net 1219556 nasubi−ing.com 5092923 1633117 aitaiyo.jp peppar.jp

1637730 9061683 bettyser.com 5092702 paradise−fish.com 376896 08053424771 340276 1164647 0332144 cherry−move.com 0346902 frury.com 428410 280138 masa−mune.com

2425448 3099458 08034984656 love−gal.com 0208028 e−sweets.jp puni−2.com 375644 5329542 love−aware.com

0588566 yamato71045.com 5340708 0423842

05055330214 0358199234 0360423 8696942 1083439 5379464 210943 1518850 nyaa−nyaa.com

adult2.net mmbga.jp 1012826 merumon.com 0339501 7716465 08065257334 value−engineer.com lovechop.net 1487263 slim−slim.jp 1010447 imazin.net 1950977 1865756 1651498 4539234 3441540 4084239 h−−ko.com 09017051122

1759710 08066575324 1185845 moe−moe.cc itigo15.jp 0388841 5093385 utubu.net 08066189305 whitelover.net 3566662 0232729 entameblog−seasea.net douganews.jp 09035485924 0353528 cherry−love.net 8453987 5336328 4073881 0359850337 3375458 5543841 312788 0384968 1391210 eroscamp.com tendencys.com 722297 08066246703 qq−o−pp.com 389841 0388018 malilin.net 3175577 cross−road.info 0120964819 qqqja.com 294566

3011261 340312 entainfo.com nixy.jp 0280138 0314398

1125163 382437 08035251179 08033857316 free−dom1.tv 6311758 6320366 1439051 343691 1640981 0350164

0120948843 2688261 cross−mode.net 11066531 3271716 0388369 ero−para.net 0354160 5095507 5333884

banana−gal.net

0475367 baxxyy.com 0418224 5333281 344238

0465175 0589849 241683 5096597 prinprin.net 5091951

08032515119 global−hotline.org 0325032 235900 0333212 0359389 club−cc.com 7630009 1670973 0372671 anything−c.com 08053422904 makkey−k.com hi−quality.net 0383644 1998870 08061313149 8140429 chocoblo.com 0344784 bi−tiku.com 7222297 5421018501 tikantitai.com 08056979249 1806363 4746756 08012452071 1482222 0388902 6618793 movie−pie333.com 2063510 entarou.com 0001963 08061313142 smile2007.jp 1641759 0251320 08034984657 1406720 entameparadise.com 4538271 1740643 5328724 1644890 fresh−tube.net 8476199 0624983 08035910928 0209571 5339815 eroerolove.com 5262219 0340004

3969268 0388570 09099538764 oreoreo.net nurevideo.com 0387134 moco−2.com 371234 5319725 sexy−pororin.com muchihip.com 4032244 0326316 1998098 0014313 3079568 0387133 5329704 hamepara.com porollin.com

anahime.info 4093947 1090428 08038207711 adult−moody.com 0344238 5333892 5335194

1051811 0353548 mukekuri.org 08054299771 5332951 0329405

0354038 hamekura.com adult−princess.com ss−class.com campus−love.jp 5319717 3855981 nukimedo.net 6649945 2172159 0661853000 09093671734 hanabi−after.com 5046551 todaysmovie.net todaysmovie.sakura.ne.jp 6338532 1455876 5333931 4090697 0404455 1086185 0120166335 0358475699 mcnsd.com 1477522 kiss−of−adult.com marmaid.cc 5093369 0331970 0448745 1414113 5343057 h−love.org 08020542531 77756 1452331 5329909 3173405 2660037 7251423 08032435833 0344551150 1492268 angelsabc.com 0363806168 1627942 0350269 1290679 1941897 0658736 okazustation.com 1628498 erumo.jp 6746509 7700913

2013974 bisyo2.net 0363806070 mac−mac.jp

4695553 entaenta.com 0357744311 4053334 lady−impact.com 09029127977 09083035035 april1980.com 09035487922 ss−class.net 0493515 2833320 6523649 345041 09055871914 09060167620 8226311 march−2008.com channel.jpn.ph honeypoo.jp erojiro.com

08055079961 3481058 lovediscovery.net 0404128 yaplog.jp adult−dougaga.com 2952751 0359999229 oman5.com vvindows.jp

6044604 09012122826 4017085 channel−av.net 08068165797

rivianan.com 5333485 4087416 08065409987

nureyubi.org 4040027 movie−h.com geinouflash.com 1065019

1237177 3095372 09018030721 1634727 09047285631 hot−spot.cc

quicklegs.org 1801712 dougadx.com mokko−gals.info

akume55.net adult−55.com ktkr.cc 2313128 8290452 idolroom.net hitodumah.net deepero.net baby−cat−be.com 1107515 nozokix.cc deeper.bz 1734316 onaona.org 3146656

1609126 bgmovie.org girl−mix.com mihoudai.com otakara−max.com be−movie.org m−hunter.net 0384305 0411692 1521668 sagjo.com sweet−tenn.net 09017729724 6811034 idol−mania.net 1383371 kaZnetmovie bm−mov.com news−club.jp 1583507 m−o−v−i8−es.com 5157963 3783847 0364576191 09045665062 admovie69.com mv69.org peroman.net 469831 5313573 honey−cute.com mv−love.org

bgmv.net 0352925692

1301074 3510627 1005560 1143219 1383733 337767 star−77.com pineapple−express−the−movie.net 6672662 rev−02.com erogazo.net 0364576188 08054295269 mvx55.org

orange−girl.net big−pink.net erostube.muvc.net 4037555 433515 8975641 8094341 3494150 h093.com gal−xx.net goo−leak.com 1739475 candysweet.cute.bz girl−box.net mv−hunter.com 0120696403 09044522789 6954047 ero−anime−star.com candy−sweets.net hasikue.net nukikko.net d−xxx.net

0120964231 0360843 4079227 mania4u.net 2182619 4443129 tere.site.ne.jp 0359445 08012315407 1120635 0369194966

av−flash.net 09038178656 movie−tubes.com 09060439730 4058108 09061234110

0450617 bmov.bz 08055089225 aneona.com 1887032 2578585 1648593 movierock.info adult−ch.com cyberpro−wingsmember.com coolwatch−dramaplayer.com 3803329 vip−ch.com fpretty.net chizyo−takyuubin.com 5416593 gazobank.net 3103382 4068802 crystal−mv.org 3091434 eroking.net temomin.net

wink69wink.com adult−maniac.com veoh−box.com guba−cafe.com view−break.com 0396753 aidol−o.net 0334074911 3698289 dlxmovie.org

0398437 8410192 fmv−str.com 8538560 myvideo−viewwatch.com ero−izm.com samehada.com 359445

tokyo−vi2.com 5242684 0412752 olioli0.com free−wmv.org f−xxx.net frx−video.info

strmv.org 0417728 1121928 e−adults.net 4044638 freehp.cc fxe.bz f−cute.com x69xforyou.com mvdx.net runkhead.net nkjnk.com 5337294 5339572 high−time.jp 1933624

4082665 08065329727 eroerotv.com 1619966 d−per.cc 0349375 4045172 fe7.org 0338530 6583868 0421581 1869828 elephin.net 2222472 0776395 kakecat.com 09017387584 7361520 0354671057 4370852 8042012 gi2a.net 09061860948 5340104 erox−mov.info cream−angel.net srmov.net erocinema.net 09012739052 8065331 sexy−shake.com 0321104 eroero−movie.net 08067622371 hs34.drive.ne.jp 1529859 5165068 ozari.com 0425703 6985815 4045610 shin−girl.com m2mv.net

1144859 o1111.com pinky−camera.net 2878099 1556604 main69.sc extasy−sp.com 6992785 4009193 erotown.biz eroing.net 1780456 09018377611 eroooo.com ony−hand.com cos.com

0403850 2866908

1535848 manko−siohuki.com 2824040

0353389795 10228026 download−page.net 2012854 x−archive.info puru−2.com 0303133 602741 angel104.com triqwe.com nuki−movie.com 1829553 cherryboy.jp 2000207 1352754 0333718464 0383656 pakipaki77.com 6580923 pearl−movie.net 08038262976 ureqky.com eroero−story.com 5341747 elite−elite.jp 4029118 09018376843 4648516

340174 0222917 goldmedia9.jp 5297837 0378050 strmovie.net

306390 heidi−alps.com 3324574 363010

mov−x.org erowiki.net otkrd.net 09065662100

shakuhati1919.com tinko4545.com 09047379105 ee−movies.net bb−download.net o−takara.org free−tube.girls−jp.com 1040522 1622740 4076368 419223 08040118481 595799 download−max.net 0402931 08038254756 q−vide0.com splash−net.jp ari−.com bottob.net

5340724 0387486 4941192 7769426

8083492 0120078310 0369632 0306583 ex−d−ex.net 2312521 o−tin.com 0347916 1647361 4040791 0598054 35122 1601834 0120100479

dream−−maker.com momoiro−time.com

5101517 0029786

0354562488 1221882 1453920 zest−movie.com 6232755

08054597956 cokimaro.com 4584380

6341843 3660931 movie−factory2.net medo−hole.org 5336573 0353530 mega−movies.net

0385093 0318332 1028012 09061861058

0385094

movies−max.com 1630265 muteking.com 0385203 0369129513 oppai777.com nurenure−movies.com download−vi.net eroero−aidol.net 0351310 0563215 adult−juice.net 5318168 moro−movies.com 1813378 0343550 cherry−pie.info 5336778 3213568 9985692 1103645 free−share.jp 08035110306 1458789 0104697 1238350 0362689 0358425 1369144 0364500337 0225244 0364500338 adult−69.com 0312320 0727136 ananan.biz 1343757 0387514 yamato.power.ne.jp

1030147 4038252 7541792 08012493978 0135448 0292684 6948954 playgirls.cc 0050056 lastsong2007.com 0348126 1537062 5337316 5341071 0120707473 1659678 adult−99.com 1928070 08013471667 0333082 ad−sexy−gallery.com 1648063 0298759 a−mn.net 478971 0162390 ero−max.biz 1635833 1929784 1064348 1767396 08013416995 1637561 6547551 09040026096 0406009

230141 2348872 ad−maruhi−club.com 5323609 peach−candy.com 09044356307

09064957153 0326011 good−eros.com 08066293236 all−look.net 0163237 specialdouga.com 0315494 382555 2808142 0387239 cute.fm pichipichipi−chi.com 08035110321 0161761 1105738 0371964 09061860949 0561112 beauty−movie.com 09098068443

daichuki.net 8459883 5317757 0387480 0385858

0286196

2039800 2124627 ikuru−to.com sexyhathurathu.com 0361645 6630471 pussy3.net blog−ex.jp 0154039 0339477 0503632 0373205 0385460 0347038

mars.server.ne.jp

0385099 arukonda.com 0063338 saunin.com 0403627

0380906 0389994 3878842 0356547159 1120502

okazu−ch.com cyuraman.com 5336565 5321550 0120540412 0145000 gazo−xxx.com adult−vision.net pink−gals.com 3114035 hippai.net 0354283294 0331806 5218287 334604 3077810 0354456 08051827956 movie−downloadpage.com 1613892 0393511

09098057510 2122373 0382799 4049462 08051893069 eroize.net h−erorist.com 5097338 08066789998 kyoto.direct.ne.jp 1434040 manboo.org 4044105 nakatayu.com 08013481402 6964085 adult−moviespecial.com

0343433 ero−station.net tadaudo.com

08051825872 momotube777.com 0400517 0478971 0441247 1161106 3262040 0354283599 1096017

5244068 1176575 1036604 .info−e.net sexsexsex.bz

1033360 0375460 nishinom.uuuq.com 8455994 3479977 click−gazou.com doshirouto.net

5338576 adultportal.bz 2051963 1056961

0261679 urageinou.com

otakara−com.net movies−navi.net 3348130 syogekiotakara.com 7552399

7019393 1369219 5878056 1647116 0069417 6132458 1126505 geinoulive.com 1702309 6239687 hitozuma−jukujo.com 08030288578 uploadotakara.com 5392821 hiroimonoblog.com 1953517 freefree−geting.com 7512014

shirotopara.com e0721.com 5084203

e−horidashi.net 08067744832 1680370 sukebe4545.com

1343544 1447503 freemovieshelter.com cupid−f.com

0104838 nurunurujp.com treasuremovieplayer.com

purememo.jp index−pv.com pyupyupyu.net 0084305 5213007

0343162 hwrws.com 1507237 1997477 2429766

4467772 6966760 1647622 0352924176 paradise−cafe.tv

tokudane.cc 09034142427 08066293227 1658483 2429774 5346307 1502037 2683998 kamehamema.com asite2006.com 0421384 adult−media3.com milkpai.net 1691135 333289 afg.adfack.com ctg.adweeb.com 0175290 5695927

09034178215 petit−devil.com sikosiko55.com 0387595 0337680

4058270 08066164856 tch.adweeb.com geinoudaisuki.com

1404764 pink−apple.net 08061148266 garumin.com 0426326 0577251 6599861 0357849501 0402084 0306538 onanny.net tohkof.adfack.com 0525881 shake−hip.net

ree.adweeb.com 5342131 0357849235 gss.adweeb.com 3442456 8059603 materiaru.com 0388662 apk.adflash.net 09094023036 4026092 09010425485 1267396 fgter.com 0388283 jyukujo−hitoduma.com

0120937959 0374643 bfg.adweeb.com 4026601 08061332300

3791080 0352343 0284256 adalt−world.com 1629329 tst.adweeb.com 0425520 5337731 boinpururun.com takuero.com

0352924109 09058210093 0352924033 love−green2.com 0558445 tpl.adweeb.com wintube.net 6191072 0583821 09098564796 4084869 6476397 0387593 lovelyhoney.adgoo.net youradult246.com 1015584 0179561 3532049 0293921 08067242335 .eromajin.net gsg.adweeb.com 1473244 0451712 1633362 2452834 0376574 hat.adweeb.com hame.adflash.net 1623524 09084891165 hamebank.adfack.com

5406408 08053276846 6600282 idol−get.net tom.adweeb.com kewpie.tv

4993545 2848342 2066983 0274806 0335845177 09017936613 1182422 hcl.adweeb.com starpeach.net 0389948

youxtube.org geinouplus.com 7685526 trinions.com pararin.net 4601959 stx.adfack.com

tof.adweeb.com 0374386 113095 1414431 5374157 1717689 3039599 08065920249 galooon.com videochannelfile−mackintoshlive−movie−tv.org douga−dx.com 3379998 8506951 yourtubefile−userforplayer−live.com 1174307 0437281 okazumovie.net okazu−movie.com 09029094733 wintube.info 3509866 1611645 tohsen.adgoo.net

mycast−watch−tv.com 08065290249 dougadx.net

forjustvideo−javadownload−watch.info 6099079

0382127 cross−mode.com 0445224 0164722 shibuya−supa.cocolog−nifty.com 1166179 0414077 0630719 3969195 4062966 3090009 0338829851 samplefreemovie.com 1970262 4517418 08065306995 0350762 4087017 0335604975 inf070614.com youtude.name sweet−tube.net r18shitei.com 05055335807 1221456319 2004024 0354598 0001682 1776495 0329168 0339320 youtude.jp 3032557 1556490 8918683 0300391 5372812 0100145 1805992 1281040 4035520 yaritai.jp yariyari−doga.com 08065920448 pp−juice.com impactfreemovie.com 08036386304 blog.kimikasa.com 6309257 he−collection.net love−cast.net onaona−doga.com e−gossip.net exite−tube.hot−jp.com 08034562094 1249683 0359850128

1022465 3107493 0507462 0187633 1038001 3008409 0383417 0339122 2005096 0279570 movie−adult999.com 3177715

eroeromax.net

7202108 cbehs.com 08067403774 xootech.net 08066706829 adult−fish.com

1080791 mediachannel−windowslive−tv.net 1663667 0352180 0375568 5651810 4021054

pure−doga.com nukenukidoga.com 0357505273 ero−tube.jp 0272017 08067441280 0638152 eroceleb.net shirouto−av.com v−gallery.net softnbank.com ero−gappa.net 0358475692 adult−007.com 09061017344 2551129 0062260 9348390 mo−movie.com venus−gate.info 2046533 0353021978 1662373 3131092 1632202 0451981 7027611 1282599

09065000870 0362807977 0338829852 0333758325 0120404306 6723957 1471895 5392597 moe−roli.com h−tuma.net 0362807950 onenight−movie.com brabus.xsrv.jp 7864096

Figure 3: Clustering of 1,341 nodes representing 481 domains (ovals), 684 bank accounts (triangles), and 176 phone numbers (small rectangles). Links connect nodes found in the same incident. We obtain 105 clusters containing more than one node, and 26 singletons (omitted from the ﬁgure). Additional grouping by malware used allows to link seven of these clusters into two groups (denoted by dashed lines), and additional grouping by strong similarities in WHOIS registrant information allows to group another set of seven clusters (represented by thick lines).

12 Malware. We further noticed that websites from the second largest connected subgraph were still alive as of Nov. 2009, indicating that the fraud continues unabated. As mentioned earlier, we downloaded the entire contents of each fraudulent website listed in our database. We found that a small number (14) of One Click Fraud websites contained some malware. Specifically, some of these sites contain a virus named Trojan.HachiLem. This is an MS Windows executable file which is posted on these sites as a “mandatory video viewer plug-in.” Once downloaded and executed, this virus automatically collects email addresses and contacts stored within Outlook Express or Becky! (email application popular with Japanese enterprise users), and sends the collected information to a central hachimitsu-lemon.com server and, possibly, to another machine as well. The collected information is in turn used to send blackmail emails to victims and notifying them they owe the website registration fees. Interestingly enough hachimitsu-lemon.com has not been a valid domain name since, at least, early October 2009, but a report about this virus was posted as recently as Oct. 26th, 2009 on Wan-Cli Zukan, indicating that this virus is still mildly active. Another group of sites contains a simpler, less intrusive form of malware, which modifies the Windows registry entries to display a pop up window reminding of the registration fee due upon boot-up.

Additional clustering. An interesting feature of the sites hosting the Trojan.HachiLem malware is that they all share strong similarities in their WHOIS records. For instance, the technical contact phone number ﬁeld contains is identical (+81-6-6241-6585). While it is likely a bogus number, this similarity, coupled with the presence of identical malware and overall similar appearance of the different websites involved strongly suggest all sites are operated by the same group. We can thus relate three connected subgraphs to each other, represented by the dashed boxes in Fig. 3. We further look into WHOIS information details, and notice that a number of registrant entries shared similarities across seemingly different incidents. For example, we found a number of entries with identical (bogus) contact name, email information, or technical contact phone number. By grouping this entries together, we can link seven connected subgraphs, represented by the thick boxes in Fig. 3, to each other.

60 1 0.9 50 0.8 40 0.7 with additional clustering basic clustering 0.6 30 basic clustering 0.5 20 0.4 with additional clustering 0.3 10 Nr. of websites maintained

Cum. prop. of webs. maint'd 0.2 0 0.1 20 40 60 80 100 20 40 60 80 100 Group rank Number of groups (a) Nr. of frauds perpetrated by each group. (b) Cumulative number of frauds

Figure 4: Frauds distribution over the miscreant groups. These plots exhibit considerable concentration in fraudulent activities.

13 Fraud distribution. With the assumption that each connected subgraph denotes a unique criminal organization, we plot, in Fig. 4, (a) the number of frauds perpetrated by each group, and (b) the cumulative number of frauds perpetrated by the most active fraudsters. In Fig. (a), we rank criminals by the number of frauds they have been committing, and plot the number of One Click Frauds perpetrated by each group as a function of its rank. We provide data for both simple clustering (based only on phone numbers, domains, and bank accounts), as well as additional clustering (further grouping criminals by malware used, and identical WHOIS records). We note that the distribution seems to be following a Zipf law. Specifically, the curve representing a basic clustering fits very well with the function y = 56/x0.76; y = 80/x0.90 is a good fit for the curve obtained by considering additional clustering. The match with a power law indicates both high concentration (a few people are responsible for most of the frauds), and long tail behavior (many people participate in these scams). We validate this observation with Fig. 4(b). Fig. 4(b) plots the same data as Fig. 4(a), but in a cumulative fashion. What we observe here, is that even with our conservative clustering strategy, the top 13 miscreant groups are responsible more than 50% of the fraud. Taking into account similarities exhibited by WHOIS records, and malware deployment, we observe that the top 8 groups are responsible for more than half of the frauds we have collected. At the same time, there is a large number of groups that do not seem to be involved in more than at most a couple of frauds. Including singletons, 80 out of the 112 groups we extracted using additional clustering, or about 71% of the criminals involved, appear to operate at most two sites. This number may be an overestimate, since we do not claim that we managed to establish all possible links that exist. Yet, it tends to indicate that the miscreant population is a mix of large operators, and of “artisans” running much more limited criminal enterprises.

4.3 Evidence of other illicit activities

Blacklist Purpose Nr. hits cbl.abuseat.org Open proxies, Spamware 7 (2.55%) dnsbl.sorbs.net Spam 22 (8%) bl.spamcop.net Spam 4 (1.45%) zen.spamhaus.org Spam, Trojans, Open proxies 23 (8.36%) combined.njabl.org Spam, Open relays 4 (1.45%) l2.apews.org Spam, Spam-friendly 90 (32.73%) aspews.ext.sorbs.net Spam 11 (4%) ix.dnsbl.manitu.net Spam 4 (1.45%) Google Safe Browsing (URLs) Phishing, Malware 0 (0%) Google Safe Browsing (IPs) Phishing, Malware 44 (16%)

Table 4: Presence of One Click Fraud domains in various blacklists.

Next, we try to see if domains engaging in One Click Fraud are also supporting other illicit activities. Out of 1608 URLs present in our database, we extract 842 domain names. These domains resolve to 275

14 unique IP addresses.3 We check the 275 IP addresses against a set of eight blacklisting services that flag IP addresses known for producing large amounts of spam, and/or trojans and malware, and present our results in Table 4. While some of the domains are also used for spam, the vast majority does not appear in any database. In fact, most of the hits we see (in L2.apews.org) are coming from sites that resolve to a parked domain IP address. That is, these sites are not active as One Click Frauds anymore, and have been reclaimed by the DNS reseller, which apparently either serves as a spam relay or has been known to be friendly to spammers. Given the results we found earlier about the concentration of frauds in some specific resellers, this outcome is not particularly surprising. We further verify this hypothesis by checking our entries against the Google Safe Browsing database distributed as part of Firefox 3, updated as of November 15, 2009. On the one hand, none of the URLs we find in our database is listed in the Google Safe Browsing database. On the other hand, when we check IP addresses of the servers that host One Click Frauds against the IP addresses of the servers hosting pages in the Google Safe Browsing database, we see a significant (16%) number of hits. This confirms our finding that, while the websites engaging in One Click Frauds keep a relatively low profile, they are sometimes hosted on very questionable servers, which essentially turn a blind eye to what their customers are doing. A possible reason for the relatively lack of conclusive evidence that One Click Frauds sites engage in other forms of online crime will become clear in the next section, when we look at the potential profits miscreants can make. Operating a set of One Click Fraud sites is indeed quite a profitable endeavor, and we conjecture that, engaging in other forms of fraud would only have a marginal benefit to the fraudster, while increasing the risk of getting caught.

5 Economic incentives

We next turn to looking into the profitability of One Click Frauds. We start by drafting a very simple economic model, before populating it with the measurements we obtained from our study. The objective is not to obtain very precise estimates of the actual profits that can be made, but mostly to be able to dimension the incentives (or disincentives) to engage in One Click Frauds. We first determine the break-even point in the absence of potential risks for miscreants, before looking at the impact of penalties (prison, fines) on criminals’ incentives. All the numbers in this section are current as of November 2009.

5.1 Cost-beneﬁt analysis

Costs. A miscreant interested in setting up a One Click Fraud will need a computer and Internet access.

We call this startup cost, Cinit. Cinit is independent of the number of frauds carried out, but is actually dependent on time, as Internet access is usually provided as a monthly subscription service. Then, the miscreant will need to purchase a DNS name, possibly joint with a web hosting service. We will call this cost Chost. This cost, too, is time-dependent.

3A large number of domains, particularly those reported in 2006–2007, are down, and do not resolve to any IP address anymore.

15 The website has then to be populated with contents (e.g., pornographic images, dating databases), which will cost Ccont. Ccont can be a ﬁxed price, or a periodic fee, depending on whether the miscreant is purchasing items in bulk, or as part of a syndicated service. The criminal has to set up a bank account, which should not be traceable back to its real identity. We will assume the cost of this operation to be Cbank. This is a ﬁxed fee. Likewise, an untraceable phone number for call-back from the victim may be purchased to make the fraud more successful. We will denote the cost associated with this purchase Cphone. This fee is likely to be time-dependent; for example, the forwarding service discussed in Section 4 is a monthly subscription.

Profits. Profits primarily come from money obtained through user payment Puser, conditioned by the number of users n paying the requested amount f for each incident. The number of users increases with time. Secondary profits, Presale, may be reaped from reselling databases of victims contact information to other miscreants.

Utility. As we have discussed before, miscreants may actually set up several frauds, potentially reusing phone numbers and bank accounts across them. Let us denote by S, K, and B the number of frauds set up, phone numbers, and bank accounts purchased by a miscreant, respectively. We assume that identical contents is reused across all frauds operated by the same miscreant, which, based on casual observation, appears to be the case. We further assume that hosting costs are directly proportional to the number of sites operated, which is a very conservative assumption, as resellers tend to provide discounts based on the number of domains purchased. We also assume that the costs of phone and banking services are directly proportional to the number of phone lines and banking accounts purchased. Finally, because quantifying

Presale is difficult, and is likely to be small in front of the other profits, we simply consider Presale ≥ 0. Finally, we assume that each fraud has roughly the same probability of being successful, and thus, that the total number of users to fall for all frauds operated by a miscreant is simply given by multiplying S by n. With these assumptions, we obtain, for the utility (i.e., the profit or loss miscreants can expect) U, the following inequality, in absence of any risks linked to being caught:

U(t) ≥ Sn(t)f − Cinit(t)

−S(Chost(t) + Ccont) − BCbank − KCphone , (1) where t denotes time. Clearly, the policy maker wants U < 0. If, on the other hand, U 0, there is a high incentive for people to start fraudulent operations.

5.2 Fraud proﬁtability

We next turn to dimensioning each of the parameters in Eqn. (1). We consider t = 1 year in all discussions. We plot the number of occurrences the most commonly requested amounts of money f are observed in our database in Fig. 5. The spike at 45,001-50,000 JPY (roughly USD 500) coincides with the average monthly amount of “pocket money” typical Japanese businessmen are allowed to take from the household

16 300

250

200

150

100 Frequency (nr. of frauds) 50

1,001−5,000 30,001−35,00035,001−40,00040,001−45,00045,001−50,00050,001−55,00055,001−60,00075,001−80,00085,001−90,00095,001−100,000

Fee amount (in yen)

Figure 5: Ten most common amounts of money requested.

income (45,600 JPY in 2008, [26]).4 The average, over 1,268 records in our database, stands at f = 60, 462 JPY.

Next, the initial cost Cinit combines that of a computer, which the fraudster likely already possesses, and of an Internet subscription. If the miscreant does not already own a computer, a basic model, around 28,000 JPY (e.g., an Asus EeePC 900X), would be more than sufﬁcient. Likewise, the miscreant probably already subscribes to an Internet service, but assuming they do not, a modest broadband access is all that they need. As an example, in 2009, Yahoo! BroadBand provides an ADSL “8 Mbps” plan for 3,904 JPY per month [8]. We get 0 ≤ Cinit ≤ 74, 848 JPY, where the upper bound is given by assuming a fully dedicated machine and Internet connection for setting up One Click Frauds, and is obtained combining the prices of purchasing a new PC and subscribing for one year to the Internet service.

We evaluate Chost using maido3.com, the most popular domain reseller and rental server used by fraudsters (see Section 4). The Starter Pack Plan costs 3,675 JPY for an initial setup fee; domain registration and DNS service is free; the plan requires a three months advance payment of 22,050 JPY (monthly fee is 7,350 JPY). We gathered these numbers from our email communication with maido3.com. For a one-year subscription, we obtain Chost = 91, 875 JPY. Fraudulent bank accounts can be obtained for prices going between 30,000 and 50,000 JPY [1] from the black market. As previously mentioned in Section 4, bank accounts are easily forged if created in Internet banks or banks requiring only postal mail for new contracts since there is no physical interaction during the contracting process. Also, it is relatively easy to set up fraudulent accounts by taking advantage of the Japanese writing system. Bank accounts internally use a phonetic alphabet (katakana), different from the characters used for most names and nouns (kanji). It is thus possible to create ambiguous account names. For instance, both the “Baking Club of Shirai City” and “Shiraishi Mitsuko” (a person’s name) are pronounced exactly the same, and thus would have the same account holder information. By registering as a non-proﬁt organization, the fraudster may easily bypass most identity checks, and subsequently set up fraudulent transfers using the individual name instead. Creating an account in this fashion would cost much

4In Japan, the wife of the household typically plays the role of “Chief Financial Ofﬁcer” and dispenses monthly allowances to the husband and children.

17 less than 50,000 JPY. We can thus conﬁdently assume Cbank ≤ 50, 000 JPY. A phone line is required for miscreants to have the ability to further pressure and blackmail the victim to pay money. Cell phones can be illegally purchased for approximately 35,000 JPY [1, 3], and can be made untraceable by paying the monthly subscription fees of 7,685 JPY/month [3] at a convenience store, or by simply using a prepaid phone. Forwarding and anonymizing services discussed in Section 4 can be purchased for only 840 JPY/month [6]. Assuming all these services are purchased for a year yields an upper bound Cphone ≤ 137, 300 JPY.

We make the modestly controversial assumption that Ccont = 0. Indeed, we suspect that most of the pornographic contents presented in One Click Fraud websites is simply copied and plagiarized from other (non-fraudulent) websites, or obtained through peer-to-peer transfers. Last, our analysis of Section 4 tells us that, on average, S ≈ 3.7 domains, while B ≈ 5.2 accounts, and K ≈ 1.3 phone lines. These numbers are obtained by looking at the graph G, and dividing, the total number of domains operated (481), bank accounts (684), and phone numbers used (176), by the number of connected subgraphs we found, including singletons (131). Reusing these numbers in Eqn (1), we obtain a simple linear condition for the fraud to be economically viable, that is, for U ≥ 0, we need n ≥ 3.8 users, to fall for each fraud, within one year. This means that, as long as, for each scam operated, more than four people fall for the scam within a year, the miscreant turns a profit. In other words, there is an extremely strong incentive for aspiring criminals to engage in One Click Fraud. This strong incentive is not very surprising, given the low amount of skills and equipment needed to set up One Click Frauds. What we find more interesting is how profitable One Click Fraud appears to be.

5.3 Legal aspects

The above incentive assessment ignores the probability of getting caught, and the associated penalties re- sulting from arrest, which we detail next.

Prosecution probability. Criminals take advantage of social norms and legal loopholes to commit One Click Frauds. First, most victims do not report these crimes. Indeed, to be able to legally charge a suspect, a victim must make a formal complaint to the court. Due to the embarrassment associated with the context of the fraud, many victims do not wish to participate in the accusations that may reveal their identity. Further complicating matters, is the fact that most DNS resellers and web hosting services used, as we have observed in our measurements, are physically situated outside of Japan. The part of the fraud infrastructure hosted in Japan, i.e., the phone line and the bank account, is equally hard to use for investigation. Indeed, police cannot obtain contact and network information from telecommunication networks unless they have an actual arrest warrant. Likewise, access to banking accounts is very restricted. Thus, prosecution probability is actually very low.

18 Date Location Damages (×106 JPY) Victims Ref. 2/2004 - 4/2005 Osaka 600 10,000+ [32] 8/2004 - 8/2005 Iwate 28 450+ [37] 7/2006 - 4/2007 Saitama 50 700+ [18] 7/2006 - 11/2007 Chiba 300 3,400+ [36] 7/2007 - 8/2008 Yamaguchi 240 3,500+ [10]

Table 5: Press reports of One Click Fraud arrests.

Penalties. In addition, sentences are relatively light. Common fraud (e.g., blackmail), in Japan, carries a sentence of up to 10 years of imprisonment. However, One Click Frauds very often do not meet the legal tests necessary for qualifying as “fraud,” as in the vast majority of cases, the victim pays up immediately, and there is no active blackmailing effort from the miscreant. One could argue that they are nothing more than a sophisticated form of panhandling. As a result, the few sentences for cases related to One Click Fraud made public [2] were rather light, with ﬁnes ranging from 300,000 JPY to 2,000,000 JPY (≈ USD 3,000 to 20,000) and prison sentences ranging from probation to 2.5 years of jail time.

5.4 Field measurements

We next use field data provided by the Japanese police [14], and compare their findings to ours. Note that the report [14] combines numbers for One Click Frauds and related confidence scams, so the numbers in this section are much more approximate than we would wish. However, they remain a useful starting point to roughly assess the economic impact of these frauds.

Number of frauds per miscreant. First, the police acknowledges, per year, 2,859 cases of frauds leading to 657 arrests. It is very unlikely that the police would inﬂate the number of unsolved cases in an external publication, and it thus appears that each arrested individual was responsible for an average of 4.4 frauds.5 This number is slightly higher than S = 3.7 we found earlier, but the difference is hardly surprising, as the probability of getting caught increases with the number of sites operated.

Profits made. The Japanese Police estimates, on average, between 2004 and 2008, that 26 billion JPY per year were swindled in various confidence scams, prominently including One Click Frauds. Dividing by the number of 2,859 cases the police reports, we find the average income per case to be approximately 9 million JPY over a year (≈ 90,000 USD), a quite staggering number, especially considering that each arrested individual was responsible for about four cases, potentially making around 360,000 USD. While we believe that this is likely an over-estimate, due to the unpublished number of unsolved cases, as well as some potential exaggeration in the losses incurred, profits made by miscreants appear sizable.

5In Japan, arrests are usually made only when the police is certain with 99% probability or more of the suspect’s guilt. The conviction rate is thus very high.

19 We can compare this estimate with reports gathered from the press, which we summarize in Table 5. The profits made appear to be very high, which is not overly surprising considering the number of victims involved. Recall from the previous section, that one only needs about four victims to break even. Clearly, with victim numbers in the 450–10,000 range, we can expect very significant profits, which, in Table 5 are estimated between approximately USD 28,000 and 600,000 for each group arrested. Thus, the USD 90,000 – 360,000 estimate acquired from the police reports seems to be in the right order of magnitude. Ironically, the case reported in [37] names the suspect as a famous IT writer specializing in cybercrime and appearing in multiple TV programs to warn the public of the dangers of One Click Fraud. One cannot help but think that the suspect, being very familiar with the inner workings of One Click Fraud, must have reached a conclusion identical to that of the present paper, that is, that there is a significant economic advantage to engage in such frauds. We also note that these arrests were likely possible by the sheer magnitude of the fraud. A criminal confining themselves to only a few dozens victims would likely be able to make a reasonable profit, while being extremely hard to catch.

6 Discussion and conclusions

This paper attempts to provide a comprehensive picture of a confidence scam used in Japan, called One Click Fraud. By gathering over 2,000 reports of incidents from vigilante websites, we were able to describe a number of potential vulnerabilities that miscreants use (lax registration checks, resellers turning a blind eye to their customers’ activities), and also showed that the market appears to be quite heavily concentrated. The top eight miscreant groups are responsible for more than half the frauds we uncovered. At the same time, a large number of individuals seem to be participating in frauds of smaller magnitude. We showed that an important reason for these scams to flourish is the strong economic incentives miscreants have. They can break even as soon as they manage to successfully scam four victims for each fraud, and, on average can make profits in the order of USD 10,000-100,000 or more per year. Prosecution is difficult, since victims are reluctant to come forward, and the penalties that can be meted are relatively light. Reforming the law to impose harsher penalties is not easy, as proving the mere existence of a crime is cumbersome. On the other hand, prevention, identification, and take-down seems more feasible. Our study shows that identifying perpetrators can greatly benefit from a bird’s eye view of the network. In our discussions with the police, we learned that different cases are usually assigned to separate officers, and that communication could be greatly improved. For instance, one officer may investigate a fraudulent phone number, while another may be investigating an online fraud. If the phone number is used in said fraud, clearly both officers would benefit from sharing the results of their investigations. However, such holistic approaches remain relatively rare in practice.

Future work. We believe that, while we tried to provide as comprehensive a study as possible, we could enrich the data we obtained by looking for connections with other forms of crime in more details. Our conclusions, thus far, are that domains involved in One Click Fraud do not apparently engage in other forms of fraud. However, these results are only based on a relatively simple check of known blacklists. Studying

20 in more details WHOIS registrations cross-listings, as well as possible connections with more “mainstream” pornographic sites could reveal further insights. Also, an article issued at the time of this writing [9] shows that One Click Fraud is now using peer-to-peer software as a propagation vector for viruses very similar to Trojan.HachiLem. While the propagation method is new, the psychological factors making such scams successful remain the same. Finding how to address these psychological traits is a promising area of research, quite related to ongoing works in security psychology [27]. We have also observed, in the police records that we eventually were not able to use, that 71 out of 359 scams reported were SMS-based. That is, One Click Frauds are also affecting mobile websites. Whether the perpetrators are the same, or different groups, remains unknown, and would warrant further investigation. Despite being focused on a very speciﬁc crime, we believe that some of the methodology we used in this paper (graph-theory based modeling, and clustering techniques, for example) could very well apply to other forms of online frauds. As mentioned in the introduction, One Click Frauds are closely related to the more general body of scareware scams, and some of the techniques we use could equally apply to analyzing scareware markets. More generally, we hope this paper will help facilitate an ambitious research agenda to gather more data from online criminal activities. An improved understanding of the economics of online crime is indeed essential in determining which policies may work to curb the problem.

7 Acknowledgments

This research beneﬁted from many discussions with Kilho Shin, Jens Grossklags, and with our colleagues at Carnegie Mellon CyLab, both at CyLab Japan and in Pittsburgh. The Hyogo Prefecture Police was instrumental in availing to us the case data used in Section 5. Ashwini Rao and Lirida Kercelli helped with some of the DNS black-listing tests. Sachi Iwata-Christin provided additional translation assistance.

References

[1] Black market yamamoto web. In Japanese. http://yamashita0721.web.fc2.com. Last accessed April 16, 2010.

[2] Koguma-neko teikoku. http://www.kogumaneko.tk.

[3] Manual on how to live anonymously. In Japanese. http://homepage3.nifty.com/nonu/tokumei1. html. Last accessed April 16, 2010.

[4] MeCab: Yet another part-of-speech and morphological analyzer. http://mecab.sourceforge.net.

[5] Ni-channeru (Channel two). http://www.2ch.net.

[6] Symphonet Services Co. In Japanese. http://symphonet.co.jp. Last accessed April 16, 2010.

[7] Wan-cli zukan. http://zukan.269g.net/.

[8] Yahoo! BB ADSL. http://bbpromo.yahoo.co.jp/adsl/type2/index.html. Last accessed April 16, 2010.

21 [9] BBC News. Porn virus publishes web history of victims on the net. http://news.bbc.co.uk/2/hi/ technology/8622665.stm. Published April 15, 2010. Last accessed April 16, 2010.

[10] Chugoku Shimbun. Arrested for one click fraud. August 16, 2008. http://www.chugoku-np.co.jp/ News/Tn200808160061.html. Last accessed November 21, 2009.

[11] Electronic Frontier Foundation. Panopticlick, 2009. Available at https://panopticlick.eff.org/. Last accessed April 10, 2010.

[12] J. Franklin, V. Paxson, A. Perrig, and S. Savage. An inquiry into the nature and causes of the wealth of internet miscreants. In Proceedings of 14th ACM Conference on Computer and Communications Security (CCS), pages 375–388, Alexandria, VA, October 2007.

[13] C. Herley and D. Florencio.ˆ Nobody sells gold for the price of silver: Dishonesty, uncertainty and the underground economy. In Proceedings (online) of the Worskshop on Economics of Information Security, June 2009. Available from http://weis09.infosecon.net/.

[14] Japan National Police Agency. Incident report and monetary damanges of direct deposit frauds, 2009. Archived at http://megalodon.jp/2010-0223-1659-40/www.npa.go.jp/safetylife/ seianki31/1_hurikome.files/Page386.htm. Last accessed April 16, 2010. In Japanese.

[15] Japanese Information Technology Promotion Agency. Virus detection reports, October 2009. In Japanese. http://www.ipa.go.jp/security/txt/2009/10outline.html. Last accessed April 20, 1010.

[16] C. Kanich, C. Kreibich, K. Levchenko, B. Enright, G. Voelker, V. Paxson, and S. Savage. Spamalytics: An empirical analysis of spam marketing conversion. In Proceedings of the Conference on Computer and Commu- nications Security (CCS), Alexandria, VA, October 2008.

[17] N. Kato and T. Kawabata. The advance of the fraudulent business scheme through the it and the legal mea- sures of speciﬁed business transaction. In Proceedings of the AIEEJ Media Computing Conference, 2007. In Japanese. Abstract available online at http://www.jstage.jst.go.jp/browse/aiieej/35/0/ _contents/-char/ja/. Last accessed April 10, 2010.

[18] Mainichi Shimbun. Fraud: Suspect arrested again for requiring a registration fee for unauthorized access. March 4, 2007. http://blog.goo.ne.jp/alladult/e/4a53e012de3c0335a838d99161e9d8bc. Last accessed April 16, 2010.

[19] Ministry of Justice, Japan. Act on special provisions to the civil code concerning electronic consumer contracts and electronic acceptance notice. English translation accessible online at http: //www.japaneselawtranslation.go.jp/law/detail/?yo=&ft=2re=01&ky=&page=3. Last accessed April 10, 2010.

[20] T. Moore and R. Clayton. Examining the impact of website take-down on phishing. In Proceedings of the Second APWG eCrime Researcher’s Summit, Pittsburgh, PA, October 2007.

[21] T. Moore and R. Clayton. Evil searching: Compromise and recompromise of internet hosts for phishing. In 13th International Conference on Financial Cryptography and Data Security, Barbados, February 2009.

[22] T. Moore, R. Clayton, and R. Anderson. The economics of online crime. Journal of Economic Perspectives, 23(3):3–20, Summer 2009.

[23] T. Moore, R. Clayton, and H. Stern. Temporal correlations between spam and phishing websites. In 2nd USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET ’09), Boston, MA, April 2009.

22 [24] T. Moore and B. Edelman. Measuring the perpetrators and funders of typosquatting. In Proceedings of the 2010 Financial Cryptography Conference (FC’10), Canary Islands, Spain, January 2010.

[25] N. Provos, P. Mavrommatis, M. Rajab, and F. Monrose. All your iFrames point to us. In Proceedings of the 17th USENIX Security Symposium, August 2008.

[26] Shinsei Financial. Japanese businessmen monthly allowance, 2009. In Japanese. http://www. shinseifinancial.co.jp/aboutus/questionnaire/kozukai2009/. Last accessed April 16, 2010.

[27] F. Stajano and P. Wilson. Understanding scam victims: Seven principles for systems security. Technical Report UCAM-CL-TR-754, Cambridge University, August 2009. To appear in Communications of the ACM.

[28] B. Stone-Gross, M. Cova, L. Cavallaro, B. Gilbert, M. Szydlowski, R. Kemmerer, C. Kruegel, and G. Vigna. Your botnet is my botnet: analysis of a botnet takeover. In Proceedings of ACM CCS’09, Chicago, IL, October 2009.

[29] P. Swire. No Cop on the Beat: Underenforcement in E-Commerce and Cybercrime. Journal on Telecommunica- tions and High Technology Law, forthcoming 2008.

[30] R. Thomas and J. Martin. The underground economy: Priceless. ;login:, 31(6):7–16, December 2006.

[31] Tokyo Metropolitan Police Association. Stop frivolous billing requests! In Japanese. http://www.anzen. metro.tokyo.jp/net/attention.html. Last accessed April 15, 2010.

[32] Tokyo Shimbun. First arrest for one click fraud, 5 individuals arrested, website owner issued a warrant of arrest, victims said to exceed 1,000 and monetary damages of up to 600 million yen. April 13, 2005. http://www6. big.or.jp/˜beyond/akutoku/news/2005/0413-10.html. Last accessed April 16, 2010.

[33] Toyo Keizai Inc. Quarterly Corporate Report Sector Map 2010. 2009.

[34] Webhosting.Info. Largest ICANN registrars, November 2009. http://www.webhosting.info/ registrars/top-registrars/global/.

[35] G. Wondracek, T. Holz, C. Platzer, E. Kirda, and C. Kruegel. Is the internet for porn? An insight into the online adult industry. In Proceedings (online) of the 9th Workshop on Economics of Information Security, Cambridge, MA, June 2010.

[36] Yomiuri Shimbun. Company president arrested for two click fraud. November 28, 2007. http://www. yomiuri.co.jp/net/security/s-news/20071128nt0c.htm. Last accessed April 16, 2010.

[37] Yomiuri Shimbun. IT writer arrested. November 8, 2005. http://www.yomiuri.co.jp/net/news/ 20051108nt03.htm. Last accessed April 16, 2010.

[38] J. Zhuge, T. Holz, C. Song, J. Guo, X. Han, and W. Zou. Studying malicious websites and the underground economy on the Chinese web. In Proceedings (online) of the Seventh Workshop on the Economics of Information Security (WEIS), Hanover, NH, June 2008.