Trafficking fraudulent accounts: the role of the underground market in Twitter spam and abuse

Abstract

As web services such as Twitter, Facebook, Google, and Yahoo now dominate the daily activities of Internet users, cyber criminals have adapted their monetization strate-gies to engage users within these walled gardens. To fa-cilitate access to these sites, an underground market has emerged where fraudulent accounts – automatically gen-erated credentials used to perpetrate scams, phishing, and malware – are sold in bulk by the thousands. In order to understand this shadowy economy, we investigate the market for fraudulent Twitter accounts to monitor prices, availability, and fraud perpetrated by 27 merchants over the course of a 10-month period. We use our insights to develop a classifier to retroactively detect several mil-lion fraudulent accounts sold via this marketplace, 95% of which we disable with Twitter’s help. During active months, the 27 merchants we monitor appeared respon-sible for registering 10–20 % of all accounts later flagged for spam by Twitter, generating $127–459K for their ef-forts. 1