{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,25]],"date-time":"2026-10-25T18:30:33Z","timestamp":1792953033137,"version":"4.5.0"},"publisher-location":"Berlin, Heidelberg","reference-count":38,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"value":"9783642044434","type":"print"},{"value":"9783642044441","type":"electronic"}],"license":[{"start":{"date-parts":[[2009,1,1]],"date-time":"2009-01-01T00:00:00Z","timestamp":1230768000000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2009]]},"DOI":"10.1007\/978-3-642-04444-1_1","type":"book-chapter","created":{"date-parts":[[2009,9,14]],"date-time":"2009-09-14T18:34:44Z","timestamp":1252953284000},"page":"1-18","source":"Crossref","is-referenced-by-count":78,"title":["Learning More about the Underground Economy: A Case-Study of Keyloggers and Dropzones"],"prefix":"10.1007","author":[{"given":"Thorsten","family":"Holz","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Markus","family":"Engelberth","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Felix","family":"Freiling","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","reference":[{"key":"1_CR1","unstructured":"Alexa, the Web Information Company. Global Top Sites (September 2008), http:\/\/alexa.com\/site\/ds\/top_sites?ts_mode=global"},{"key":"1_CR2","unstructured":"Anderson, D.S., Fleizach, C., Savage, S., Voelker, G.M.: Spamscatter: Characterizing Internet Scam Hosting Infrastructure. In: USENIX Security Symposium (2007)"},{"key":"1_CR3","unstructured":"Anonymous. Comment about posting \u201cGood ol\u2019 #CCpower\u201d on honeyblog (June 2008), http:\/\/honeyblog.org\/archives\/194-CCpower-Only-Scam.html"},{"key":"1_CR4","unstructured":"AutoIt Script Home Page (2009), http:\/\/www.autoitscript.com\/"},{"key":"1_CR5","unstructured":"Chandrasekaran, M., Chinchani, R., Upadhyaya, S.: PHONEY: Mimicking User Response to Detect Phishing Attacks. In: Symposium on World of Wireless, Mobile and Multimedia Networks, WoWMoM (2006)"},{"key":"1_CR6","doi-asserted-by":"crossref","unstructured":"Choi, T., Son, S., Gouda, M., Cobb, J.: Pharewell to Phishing. In: Symposium on Stabilization, Safety, and Security of Distributed Systems, SSS (2008)","DOI":"10.1007\/978-3-540-89335-6_19"},{"key":"1_CR7","unstructured":"Chou, N., Ledesma, R., Teraguchi, Y., Mitchell, J.C.: Client-Side Defense Against Web-Based Identity Theft. In: Network and Distributed System Security Symposium, NDSS (2004)"},{"key":"1_CR8","doi-asserted-by":"crossref","unstructured":"Dhamija, R., Tygar, J.D.: Battle Against Phishing: Dynamic Security Skins. In: Symposium on Usable Privacy and Security, SOUPS (2005)","DOI":"10.1145\/1073001.1073009"},{"key":"1_CR9","unstructured":"Finjan: Malicious Page of the Month (April 2008), http:\/\/www.finjan.com\/Content.aspx?id=1367"},{"key":"1_CR10","unstructured":"Franklin, J., Paxson, V., Perrig, A., Savage, S.: An Inquiry Into the Nature and Causes of the Wealth of Internet Miscreants. In: Conference on Computer and Communications Security, CCS (2007)"},{"key":"1_CR11","unstructured":"Gajek, S., Sadeghi, A.-R.: A Forensic Framework for Tracing Phishers. In: IFIP WG 9.2, 9.6\/11.6, 11.7\/FIDIS International Summer School on The Future of Identity in the Information Society, Karlstad University, Sweden (August 2007)"},{"key":"1_CR12","unstructured":"Herley, C., Florencio, D.: How To Login From an Internet Cafe Without Worrying About Keyloggers. In: Symposium on Usable Privacy and Security, SOUPS (2006)"},{"key":"1_CR13","doi-asserted-by":"crossref","unstructured":"Holz, T., Engelberth, M., Freiling, F.: Learning More About the Underground Economy: A Case-Study of Keyloggers and Dropzones. Technical Report TR-2008-006, University of Mannheim (2008)","DOI":"10.1007\/978-3-642-04444-1_1"},{"key":"1_CR14","unstructured":"Internet Crime Complaint Center (IC3). 2008 Internet Crime Report (March 2009), http:\/\/www.ic3.gov\/media\/annualreports.aspx"},{"key":"1_CR15","doi-asserted-by":"crossref","unstructured":"Kanich, C., Kreibich, C., Levchenko, K., Enright, B., Voelker, G.M., Paxson, V., Savage, S.: Spamalytics: An Empirical Analysis of Spam Marketing Conversion. In: Conference on Computer and Communications Security, CCS (2008)","DOI":"10.1145\/1455770.1455774"},{"key":"1_CR16","unstructured":"Kirda, E., Kruegel, C., Banks, G., Vigna, G., Kemmerer, R.: Behavior-based Spyware Detection. In: USENIX Security Symposium (2006)"},{"key":"1_CR17","doi-asserted-by":"crossref","unstructured":"Linn, C., Debray, S.: Obfuscation of Executable Code to Improve Resistance to Static Disassembly. In: Conference on Computer and Communications Security, CCS (2003)","DOI":"10.1145\/948109.948149"},{"key":"1_CR18","unstructured":"MaxMind LLC. MaxMind GeoIP (August 2008), http:\/\/www.maxmind.com\/app\/ip-location"},{"key":"1_CR19","unstructured":"Luhn, H.P.: Computer for Verifying Numbers (August 1960) U.S. Patent 2,950,048"},{"key":"1_CR20","unstructured":"Martin, J., Thomas, R.: The underground economy: priceless. USENIX; login: 31(6) (December 2006)"},{"key":"1_CR21","unstructured":"McCune, J.M., Perrig, A., Reiter, M.K.: Bump in the Ether: A Framework for Securing Sensitive User Input. In: USENIX Annual Technical Conference (2006)"},{"key":"1_CR22","unstructured":"Microsoft. Protected Storage (Pstore), Microsoft Developer Network (MSDN) (August 2008)"},{"key":"1_CR23","doi-asserted-by":"crossref","unstructured":"Moser, A., Kruegel, C., Kirda, E.: Exploring Multiple Execution Paths for Malware Analysis. In: IEEE Symposium on Security and Privacy (2007)","DOI":"10.1109\/SP.2007.17"},{"key":"1_CR24","doi-asserted-by":"crossref","unstructured":"Moser, A., Kruegel, C., Kirda, E.: Limits of Static Analysis for Malware Detection. In: Annual Computer Security Applications Conference, ACSAC (2007)","DOI":"10.1109\/ACSAC.2007.21"},{"key":"1_CR25","unstructured":"Newsome, J., Song, D.X.: Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software. In: Network and Distributed System Security Symposium, NDSS (2005)"},{"key":"1_CR26","unstructured":"Popov, I.V., Debray, S.K., Andrews, G.R.: Binary Obfuscation Using Signals. In: USENIX Security Symposium (2007)"},{"key":"1_CR27","unstructured":"The\u00a0Honeynet Project. Know Your Enemy: Learning About Security Threats, 2nd edn. Addison-Wesley Longman (2004)"},{"key":"1_CR28","unstructured":"Provos, N., Mavrommatis, P., Rajab, M.A., Monrose, F.: All Your iFRAMEs Point to Us. In: USENIX Security Symposium (2008)"},{"issue":"4","key":"1_CR29","doi-asserted-by":"publisher","first-page":"291","DOI":"10.1145\/1151659.1159947","volume":"36","author":"A. Ramachandran","year":"2006","unstructured":"Ramachandran, A., Feamster, N.: Understanding the Network-Level Behavior of Spammers. SIGCOMM Comput. Commun. Rev.\u00a036(4), 291\u2013302 (2006)","journal-title":"SIGCOMM Comput. Commun. Rev."},{"key":"1_CR30","unstructured":"SecureWorks. PRG Trojan (June 2007), http:\/\/www.secureworks.com\/research\/threats\/prgtrojan\/"},{"key":"1_CR31","unstructured":"SecureWorks. Coreflood Report (August. 2008), http:\/\/www.secureworks.com\/research\/threats\/coreflood-report\/"},{"key":"1_CR32","unstructured":"Stahlberg, M.: The Trojan Money Spinner. In: Virus Bulletin Conference (2007)"},{"key":"1_CR33","unstructured":"Symantec: Global Internet Security Threat Report: Trends for July \u2013 December 07 (April 2008)"},{"key":"1_CR34","unstructured":"Symantec. Report on the Underground Economy July 07 \u2013 June 08 (November 2008)"},{"key":"1_CR35","unstructured":"Wang, X., Li, Z., Li, N., Cho, J.Y.: PRECIP: Towards Practical and Retrofittable Confidential Information Protection. In: Network and Distributed System Security Symposium, NDSS (2008)"},{"key":"1_CR36","unstructured":"Wang, Y.-M., Beck, D., Jiang, X., Roussev, R., Verbowski, C., Chen, S., King, S.T.: Automated Web Patrol with Strider HoneyMonkeys: Finding Web Sites That Exploit Browser Vulnerabilities. In: Network and Distributed System Security Symposium, NDSS (2006)"},{"issue":"2","key":"1_CR37","doi-asserted-by":"publisher","first-page":"32","DOI":"10.1109\/MSP.2007.45","volume":"5","author":"C. Willems","year":"2007","unstructured":"Willems, C., Holz, T., Freiling, F.: Toward Automated Dynamic Malware Analysis Using CWSandbox. IEEE Security & Privacy Magazine\u00a05(2), 32\u201339 (2007)","journal-title":"IEEE Security & Privacy Magazine"},{"key":"1_CR38","doi-asserted-by":"crossref","unstructured":"Yin, H., Song, D., Egele, M., Kruegel, C., Kirda, E.: Panorama: Capturing System-wide Information Flow for Malware Detection and Analysis. In: Conference on Computer and Communications Security, CCS (2007)","DOI":"10.1145\/1315245.1315261"}],"container-title":["Lecture Notes in Computer Science","Computer Security \u2013 ESORICS 2009"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-642-04444-1_1","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,2,12]],"date-time":"2025-02-12T04:19:32Z","timestamp":1739333972000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-642-04444-1_1"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2009]]},"ISBN":["9783642044434","9783642044441"],"references-count":38,"URL":"https:\/\/doi.org\/10.1007\/978-3-642-04444-1_1","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2009]]}}}