Spamscatter: characterizing internet scam hosting infrastructure

Abstract

Few Internet security issues have attained the universal public\nrecognition or contempt of unsolicited bulk email -- SPAM. The engine that\ndrives this enormous activity is not spam itself -- which is simply a means to\nan end -- but the various money-making ``scams'' (legal or illegal) that\nextract value from Internet users. In this paper, we focus on the Internet\ninfrastructure used to host and support such scams. Unlike mail-relays or\nbots, scam infrastructure is directly implicated in the spam profit cycle and\nthus considerably rarer and more valuable. Our goal is to measure and analyze\nthis scam infrastructure to better understand the dynamics and business\npressures exerted on spammers. To identify scam infrastructure, we employ an\nopportunistic technique called spamscatter. The underlying principal is that\neach scam is, by necessity, identified in the link structure of associated\nspams. To this end, we have built a system that mines email, identifies URLs\nin real time and follows such links to their eventual destination server. We\nfurther identify individual scams by clustering scam servers whose rendered Web\npages are graphically similar using a technique called image shingling. Using\nthe spamscatter technique on a large real-time spam feed (roughly 150,000 per\nday) we identify and analyze over 2,000 distinct scams hosted across more than\n7,000 distinct servers.Pre-2018 CSE ID: CS2007-0887