PaperlayerView exact revision on arXiv

Source-linked AI summary

Dial One for Scam: A Large-Scale Analysis of Technical Support Scams

Najmeh Miramirkhani, Oleksii Starov, Nick Nikiforakis

arXiv:1607.06891v3cs.CR

TL;DR

Technical support scams are an understudied attack on everyday web users, who may be persuaded to grant remote access and pay hundreds of dollars. The paper combines automated scam discovery with controlled interactions to document the scams’ infrastructure and tactics, while identifying limits in detection and source coverage.

  • Problem

    Technical support scams are an understudied attack targeting everyday web users, who may grant remote access and pay scammers hundreds of dollars.

    Source: §I · p. 1

  • Method

    The authors built ROBOVIC to collect scam pages and numbers from malvertising-related sources, then conducted 60 IRB-approved sessions with scammers using disposable virtual machines.

    Source: §I · p. 1, B. Tool design and implementation · p. 3

  • Results

    The 250-day crawl found 8,698 scam domains and 1,581 phone numbers; among 60 scammers, 81% relied on two remote-administration products, calls averaged 17 minutes, and requested repairs averaged $290.9.

    Source: §I · p. 1, E. Summary of findings · p. 12

  • Takeaways & Limitations

    The authors argue that educating users not to trust these pages is unlikely to harm legitimate businesses, since webpages cannot know that a user is infected.

    Source: §VI · p. 13

    The work may miss scam domains because its discovery sources are incomplete, and scammers may evade ROBOVIC’s current detection heuristics.

    Source: §VI · p. 13

Abstract

from arXiv · show

In technical support scams, cybercriminals attempt to convince users that their machines are infected with malware and are in need of their technical support. In this process, the victims are asked to provide scammers with remote access to their machines, who will then "diagnose the problem", before offering their support services which typically cost hundreds of dollars. Despite their conceptual simplicity, technical support scams are responsible for yearly losses of tens of millions of dollars from everyday users of the web. In this paper, we report on the first systematic study of technical support scams and the call centers hidden behind them. We identify malvertising as a major culprit for exposing users to technical support scams and use it to build an automated system capable of discovering, on a weekly basis, hundreds of phone numbers and domains operated by scammers. By allowing our system to run for more than 8 months we collect a large corpus of technical support scams and use it to provide insights on their prevalence, the abused infrastructure, the illicit profits, and the current evasion attempts of scammers. Finally, by setting up a controlled, IRB-approved, experiment where we interact with 60 different scammers, we experience first-hand their social engineering tactics, while collecting detailed statistics of the entire process. We explain how our findings can be used by law-enforcing agencies and propose technical and educational countermeasures for helping users avoid being victimized by technical support scams.

I. INTRODUCTION

Technical support scams exploit users’ fear of infection, yet their operations had not been studied systematically. The paper combines automated discovery, corpus analysis, and controlled interactions with scammers to characterize the scams and propose protections.

I. INTRODUCTION

  • The security community had no systematic study of technical support scams; available details came from victim recollections and ad-hoc analysis of a handful of scams.The scams cost users millions of dollars yearly.Source: §I · p. 1
  • In 250 days, the system found 8,698 scam domains and 1,581 phone numbers, automatically discovering hundreds of new domains and numbers each week.The authors describe it as the first such system that does not rely on manual labor or crowdsourcing.Source: §I · p. 1
  • Corpus analysis found low-cost domains and CDNs abused for scams, four providers handling over 90% of numbers, and scam campaigns often lasting under 50 days.The authors also estimate scammers made more than $9 million from a small fraction of monitored domains.Source: §I · p. 1
  • Across 60 scammer interactions, 81% used one of two remote administration tools, the average requested charge was $290.9, and the average call center housed 11 scammers.Scammers used more than 12 techniques to convince users they were infected.Source: §I · pp. 1–2
  • The authors propose public education and an in-browser “panic button” for non-technical users who feel threatened by a webpage.A typical scam page claims infection, urges a call, and uses intrusive JavaScript to make leaving difficult; the scammer then seeks remote access and payment.Source: §I · p. 2, §II · p. 2

III. DATA COLLECTION AND ANALYSIS

The study uses malvertising sources to find scam pages, then ROBOVIC crawls, detects, and tracks them. Its design addresses adversarial pages and transient scam appearances, while manual review checks the detector’s coverage.

A. Source of technical support scam pages

  • The study uses domain parking and ad-based URL shorteners as gateways to malvertising, without claiming scammers explicitly collaborate with those services.Typosquatting variants of popular domains are used to reach parked sites that sometimes redirect visitors to scams.Source: A. Source of technical support scam… · pp. 2–3

B. Tool design and implementation

  • ROBOVIC collects page and network evidence using an instrumented browser, while its detector scores popup content against keyword rules and a tuned threshold.The crawler is designed to interact with scam pages without becoming trapped; its deployment used typosquatting domains and shortened URLs across campus and two cloud instances.Source: B. Tool design and implementation · p. 3, Figure 2 · p. 3
  • Manual review of 17,000 screenshots from three sampled days found that the heuristic captured all scams collected by ROBOVIC during those days.Some pages drew fake alerts in HTML but switched to native JavaScript alerts when users tried to leave.Source: B. Tool design and implementation · pp. 3–4
  • The Liveness Checker recrawls detected URLs and neighboring URLs daily, counting a scam as alive when any matches the scam-page heuristic.Its lifetime definition spans scam-positive pages while allowing for transient outages and changes in malvertising content.Source: B. Tool design and implementation · p. 4

IV. DATA ANALYSIS

Over 36 weeks, ROBOVIC collected scam domains and phone numbers from three locations. The results show growing domain counts, location-dependent detection, dynamic phone-number assignment, and short scam-domain lifetimes.

IV. DATA ANALYSIS

  • During the 36-week collection period, ROBOVIC attempted to resolve 8.4 million domains and gathered 15 TB of crawling data.Of the five million resolved domains, 22,000 URLs were detected as scam pages across 8,698 unique domains.Source: §IV · p. 4, A. Discovered scams · p. 4

A. Discovered scams

  • ROBOVIC’s three deployed instances found more than 1,000 unique technical-support scam domains per week in April and May 2016, while phone numbers could not keep pace with that growth.Source: A. Discovered scams · p. 4
  • The campus crawler found 95.7% of all unique domains and 92.8% of unique phone numbers; Linode and Amazon together contributed only 7.6% of unique domains.The authors attribute the disparity to ad networks and attackers using visitors’ IP addresses to evade crawlers on popular commercial clouds.Source: A. Discovered scams · p. 4
  • Scam domains and phone numbers were correlated but not one-to-one, because domains could share numbers and page numbers could change between loads.Ten percent of corpus domains used Retreaver code to obtain dynamically assigned numbers, which could be tagged and routed to a configured call center.Source: A. Discovered scams · pp. 4–5
  • 43% of scam domains were reachable for up to three days after discovery, while 7% remained reachable for more than 40 days.The domain-lifetime distribution had a long tail.Source: A. Discovered scams · p. 5

B. Domain names

Scammers used deceptive domain naming, inexpensive hosting, and infrastructure choices that complicate blacklisting. Scam domains were often long, while some used CDNs and Cloudflare.

B. Domain names

  • 83% of scam domains contained at least one random string, while 17% were fully human-readable and 6% used CDNs.The most common domain words were techsupport, alert, pc, security, and windows.Source: B. Domain names · p. 5
  • CDNs offered free or near-free scam-page hosting and random-string URLs that could not be guessed, while blocking an entire CDN risked collateral damage.The authors note that these URLs could not be preemptively blacklisted.Source: B. Domain names · p. 5
  • Scam domains averaged 76±56 characters versus 12±3.5 for the top 8K Alexa domains, and long domains were used to evade browser pop-up suppression.The reported distribution difference was significant (p<0.05).Source: B. Domain names · p. 5
  • After removing CDN entries, 1,524 TLD+1 domains resolved to 685 IP addresses; 88% of scam-page hosting was in the US, and 18% of scam hosts used Cloudflare to hide their servers.The paper links shared hosting to cheap domains and hosting that can be changed to evade blacklisting.Source: B. Domain names · p. 5

C. Phone numbers and their relationship to domains

Scam campaigns reuse phone numbers across domains and may change numbers over time, while campaign lifetime and page tactics reveal how operators sustain and present scams.

C. Phone numbers and their relationship to domains

  • The 1,581 toll-free numbers spanned 15 providers, but more than 90% belonged to four; 77.5% had been activated less than a year earlier.The four providers were Twilio, WilTel, RingRevenue, and Bandwidth.Source: C. Phone numbers and their… · p. 6
  • Campaign graphs show phone numbers reused across domains and domains advertising different numbers; after merging nodes by TLD+1, default fallback numbers connected to many campaign domains.The merged graph contained 434 components; the six central numbers were defaults used when on-the-fly number retrieval failed.Source: C. Phone numbers and their… · p. 6
  • 69% of campaigns lasted less than 50 days, but some exceeded 250 days; larger campaigns tended to last longer (r=0.5).Average estimated lifetime was 45 days; lifetime is measured from the first to last domain or phone number added to a campaign graph.Source: C. Phone numbers and their… · p. 6
  • The five largest campaigns differed in toll-free prefixes, TLDs, hosting infrastructure, and estimated lifetime, and often used cheap TLDs such as .xyz, .space, and .club.The first two campaigns had diverse infrastructure and hid hosting servers behind Cloudflare.Source: C. Phone numbers and their… · p. 6, Table I · p. 6

D. Page contents

  • The scam-page word cloud highlights frequently used terms, with each word’s size correlated with its frequency in the collected corpus.The passage describes the visualization but does not provide the specific words shown.Source: D. Page contents · pp. 6–7
  • 49% of scams used long alert messages padded with whitespace and newlines to hide Chrome’s dialog-suppression checkbox; others combined event handlers, alerts, pop-ups, and subdomains.Internet Explorer lacks the described mechanism for suppressing alert dialogues.Source: D. Page contents · p. 7
  • 87% of discovered scam pages used HTML audio tags to autoplay repeating alarms or text-to-voice messages urging users to call.The messages emphasized the purported severity of the problem.Source: D. Page contents · p. 7

E. Sufficiency of existing blacklists

The evaluated domain and phone blacklists covered only a fraction of the collected scams, and some detections arrived well after discovery. Mobile apps provided especially little coverage.

E. Sufficiency of existing blacklists

  • Only 108 of 1,524 scam domains (7%) were in the evaluated blacklists, and just 16 were listed when ROBOVIC first detected them.The rest were blacklisted an average of 38 days after detection; only 28 of 685 resolved IP addresses were already listed.Source: E. Sufficiency of existing blacklists · p. 7
  • VirusTotal detected 974 of 1,524 TLD+1 domains (about 64%), but on average only 3.25 AV engines detected each domain.The authors could not determine when VirusTotal first detected the domains; it has 68 AV engines.Source: E. Sufficiency of existing blacklists · p. 7
  • Phone lookup websites covered less than 20% of scam numbers, while every tested mobile app detected less than 1% of the 1,581 numbers.For two websites, more than 25% of detected numbers were discovered by ROBOVIC an average of 44 days before the earliest user complaint; across all apps and websites, users would cover less than 30%.Source: E. Sufficiency of existing blacklists · p. 8, Table II · p. 8
  • Some scam numbers also drew complaints involving fake law firms, debt collectors, and IRS scams.The study found 10 such cases on mrnumber.com and 24 on 800notes.com.Source: E. Sufficiency of existing blacklists · p. 8

F. Estimating the number of victims, their location, and scammer profits

The study estimated visitor volume, geography, and potential scam proceeds from exposed server statistics, while separately describing the method used to investigate interactions with scammers.

F. Estimating the number of victims, their location, and scammer profits

  • Monitoring 142 scam domains over two months found 1,688,412 unique visitor IP addresses; each domain averaged 11,890 visitors (about 224 per day), and the maximum per-domain count was 138,514.Source: F. Estimating the number of victims,… · p. 8
  • Visitors most often came from the United States (33.6%), Australia (25.36%), Singapore (22.40%), Canada (7%), and New Zealand (4.8%).The authors say this pattern indicates targeting of English-speaking countries.Source: F. Estimating the number of victims,… · p. 8
  • Assuming a 2% conversion rate, the authors estimated 33,768 purchasers and more than $9.7 million in proceeds from the 142 monitored domains.The conversion-rate assumption was based on users paying for the full version of a fake antivirus, and the average package price was $290.Source: F. Estimating the number of victims,… · p. 8

G. Summary of findings

  • Across the experiment, scammers used thousands of domains and numbers, intrusive navigation-blocking techniques, and on-the-fly phone-number delivery; monitored-domain proceeds were estimated above $9 million.The authors also report poor blacklist coverage and that some successful scammers remained active throughout the experiment.Source: G. Summary of findings · p. 8

V. INTERACTING WITH SCAMMERS

  • To study scammer interactions, the researchers posed as technically unsavvy users, called 60 scammers, and recorded the sessions to examine access methods, persuasion tactics, call duration, and requested charges.The passage frames these interactions as addressing questions not answered by measurements of scam domains alone.Source: §V · pp. 8–9

A. Experiment Preparation

The authors conducted an observational study of scammers through recorded calls, using realistic virtual machines and a scripted victim persona. They describe their ethical safeguards, data collection, and interaction protocol, while noting that their findings do not cover what happens after payment.

A. Experiment Preparation

  • The study was observational: researchers posed as victims and recorded interactions rather than applying treatments to scammers.The authors argue that scammers’ control of most conversations makes the results aggregatable and generalizable to scam sessions; transcripts of five calls showed scammers spoke nearly three times as many words as the researchers.Source: A. Experiment Preparation · p. 9, C. Script for our interactions · p. 9

B. Data Sources and Data Collection

A. Experiment Preparation

  • Each scammer received access to an aged, isolated Windows 7 virtual machine that researchers could restore to a clean state after the call.The researchers populated the desktop and browsing history with ordinary content and removed obvious virtualization signs.Source: A. Experiment Preparation · p. 9

B. Data Sources and Data Collection

  • Researchers randomly sampled discovered numbers, called each no more than once, and recorded audio, network traffic, and on-screen actions.They treated the numbers as scams because ROBOVIC pages used alerts to obstruct navigation and urged users to call.Source: B. Data Sources and Data Collection · p. 9

C. Script for our interactions

  • Researchers acted as nontechnical users, followed scammers’ instructions, and ended calls shortly after receiving prices.In the final ten calls, they challenged the scammers after the price offer to observe their reactions.Source: C. Script for our interactions · p. 9
  • The researchers did not pay scammers, so the study could not examine their behavior after they charged users.They cite ethical concerns and estimate that paying 30 scammers would have put about $9,000 into cybercriminal hands.Source: C. Script for our interactions · p. 9

D. Results

The recorded calls show scammers using legitimate remote-access tools and misrepresenting ordinary system information to sell support services. The study also measures call duration and prices, estimates call-center size, and reports IP-based location results with attribution limits.

Remote administration tools

  • Scammers used legitimate remote-access applications and programs, sometimes incorporating their warnings into their narratives or using older versions without warnings.The tools included LogMeIn Rescue, CITRIX GoToAssist, TeamViewer, and AnyDesk.Source: D. Results · p. 10, Table III · p. 10

Social-engineering techniques

  • 67% of scammers portrayed stopped Windows services as evidence of hackers, while others treated Event Viewer errors as signs of hacker activity.Stopped services are a normal Windows state, according to the passage.Source: D. Results · p. 10, Table IV · p. 10
  • 40% used netstat connections and 40% used fake command-line scans to suggest infection; some also praised users’ hardware to justify repair costs.The fake scan technique inserted virus warnings into output that appeared to come from the operating system itself.Source: D. Results · pp. 10–11

Duration of calls

  • 17 minutes was the average time to a price offer; the authors suggest calls exceeding 41 minutes may identify likely defrauded victims.Across 60 calls, researchers spent more than 1,300 minutes interacting with scammers, excluding dropped calls and analysis.Source: D. Results · p. 11, Figure 11 · p. 11

Price of services

  • $290.9 was the average support price; packages ranged from $69.99 to $999.99, and price did not correlate with persuasion time (Pearson r=0.11).Most scammers offered two or three packages and typically kept all options under $500.Source: D. Results · p. 11, Figure 12 · p. 11

Freelance scammers vs organized call centers

  • 62% of calls had audible background voices, and the estimated call centers averaged 11 scammers, ranging from 5 to 19.The size estimate counted volunteers able to reach a scammer or wait in a queue during a simultaneous 90-second calling period.Source: D. Results · pp. 11–12

Scammer Location

  • The researchers recovered IP addresses from 41 of 60 scams; 85.4% geolocated to India, 9.7% to the US, and 4.9% to Costa Rica.They caution that VPN use cannot be ruled out and that the people operating call centers may be outsourced workers rather than the responsible scammers.Source: D. Results · p. 12

Scammer Demeanor

  • Scammers were generally patient and kind, but in the final ten calls 40% became rude and ended the call after being challenged.The remaining 60% stayed calm and polite and tried to support their company’s legitimacy with online information.Source: D. Results · p. 12

E. Summary of findings

The authors quantify scammers’ remote-access tools, persuasion tactics, call duration, and requested charges through recorded interactions. They also estimate call-center size and use network traces to identify likely locations.

E. Summary of findings

  • Scammers used two specific remote-access tools in 81% of cases, spent an average of 17 minutes persuading users, and requested an average of $290.9.The authors also estimated an average call-center size and identified likely operating countries through geolocated network traces.Source: E. Summary of findings · p. 12

VI. DISCUSSION AND FUTURE WORK

The authors characterize technical support scams as a threat in which victims may willingly accept charges and disclose private information. They propose public education and browser support, while identifying limits in scam discovery and detection.

VI. DISCUSSION AND FUTURE WORK

  • Scams can lead victims to accept charges and voluntarily disclose private and financial information over the phone.The authors contrast this direct monetization with cybercrimes that require additional monetization effort.Source: §VI · p. 12

User Education

  • Public education could explain that webpages cannot know a user is infected and should not use threatening alert floods.The authors argue that warning users not to trust such pages is unlikely to harm legitimate remote-support businesses.Source: §VI · p. 13

Browser Support

  • Browser session restoration can reopen a scam tab after reboot, leaving a nontechnical user trapped on the page.The authors argue users should not be expected to outrun alerts, kill the browser, or clear recent history.Source: §VI · p. 13
  • A universal browser shortcut could close the current tab or all tabs and navigate to a safe page, bypassing webpage event handlers.The authors propose communicating the shortcut through public service announcements and note it could help with other intrusive websites.Source: §VI · p. 13

Limitations

  • The authors identify two limits: scammers may evade ROBOVIC’s current heuristics, and malvertising-driven discovery cannot guarantee complete coverage.They note that scammers have constrained evasion options and that their discovery approach focuses pragmatically on malvertising.Source: §VI · p. 13

VII. RELATED WORK

Prior technical-support-scam research was ad hoc, while this work presents a systematic quantitative study combining automated discovery, infrastructure analysis, and controlled scammer interactions. It distinguishes these scams from related scareware and telephone-scam research and explains why earlier phone-honeypot approaches do not discover the active webpage scams studied here.

VII. RELATED WORK

  • Earlier technical-support-scam accounts were ad hoc and not generalizable, leaving repeatable discovery, blacklist sufficiency, victim and loss estimates, clustering, and scammer statistics unreported.The paper identifies these gaps using a corpus of thousands of domains and phone numbers as its basis for comparison.Source: §VII · p. 13
  • The study combines an eight-month distributed crawl, analysis of thousands of domains and phone numbers, and controlled experiments to provide the first systematic quantitative investigation of technical support scams.The experiments measured scammer techniques, tools, call-center infrastructure, and charges.Source: §VII · pp. 13–14
  • The paper places technical support scams at the crossover of scareware and telephone scams such as vishing, within broader cybercrime and underground-ecosystem research.Related scareware studies examined domain campaigns, social engineering, criminal earnings and affiliates, and perceptual hashing.Source: §VII · p. 14
  • Prior telephone-scam studies analyzed user-reported or crowdsourced data, whereas this work develops ROBOVIC to automatically find technical-support scams without an available dataset.The cited phone-number tracking approach using HRL queries applies only to mobile phones, not toll-free numbers.Source: §VII · p. 14
  • A phone honeypot attracted 1.3 million calls to 40,000 numbers in seven weeks, but discovering the active webpage scams studied here requires a tool that finds pages and numbers.The honeypot research found older phone numbers attracted more calls than newer ones.Source: §VII · p. 14

VIII. CONCLUSION

The study systematically investigates technical support scams through automated discovery and interactions with scammers. It documents abused infrastructure and scammer practices, and proposes user education and browser assistance as countermeasures.

VIII. CONCLUSION

  • The crawling system collected thousands of scam domains and phone numbers, clustered them into campaigns, and identified browser API abuse that makes scam pages harder to leave.The paper proposes a browser feature to help users navigate away from malicious pages.Source: §VIII · p. 14
  • Across more than 22 hours of interaction with 60 scammers, the researchers identified social-engineering techniques, remote-administration tools, and charges.Source: §VIII · p. 14
  • The study places scammers in call centers in low-wage English-speaking countries and describes a complex, multi-party ecosystem, motivating user education and browser countermeasures.Source: §VIII · p. 14

Related papers

Loading 1607.06891v3…