{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,16]],"date-time":"2025-10-16T20:33:39Z","timestamp":1760646819389,"version":"3.41.0"},"publisher-location":"New York, New York, USA","reference-count":69,"publisher":"ACM Press","license":[{"start":{"date-parts":[[2018,1,1]],"date-time":"2018-01-01T00:00:00Z","timestamp":1514764800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"US Department of Commerce","award":["2106DEK","2106DZD"],"award-info":[{"award-number":["2106DEK","2106DZD"]}]},{"name":"Air Force Research Laboratory\/Defense Advanced Research Projects Agency (DARPA)","award":["2106DTX"],"award-info":[{"award-number":["2106DTX"]}]},{"name":"National Science Foundation (NSF)","award":["CNS-1514035","CNS-1617593","CNS-1617902"],"award-info":[{"award-number":["CNS-1514035","CNS-1617593","CNS-1617902"]}]},{"name":"Office of Naval Research (ONR)","award":["N00014-16-1-2264"],"award-info":[{"award-number":["N00014-16-1-2264"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2018]]},"DOI":"10.1145\/3178876.3186098","type":"proceedings-article","created":{"date-parts":[[2018,4,13]],"date-time":"2018-04-13T15:53:48Z","timestamp":1523634828000},"page":"319-328","source":"Crossref","is-referenced-by-count":29,"title":["Exposing Search and Advertisement Abuse Tactics and Infrastructure of Technical Support Scammers"],"prefix":"10.1145","author":[{"given":"Bharat","family":"Srinivasan","sequence":"first","affiliation":[{"name":"Salesforce.com, San Francisco, CA, USA"}]},{"given":"Athanasios","family":"Kountouras","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}]},{"given":"Najmeh","family":"Miramirkhani","sequence":"additional","affiliation":[{"name":"Stony Brook University, Stony Brook, NY, USA"}]},{"given":"Monjur","family":"Alam","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}]},{"given":"Nick","family":"Nikiforakis","sequence":"additional","affiliation":[{"name":"Stony Brook University, Stony Brook, NY, USA"}]},{"given":"Manos","family":"Antonakakis","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}]},{"given":"Mustaque","family":"Ahamad","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}]}],"member":"320","reference":[{"key":"key-10.1145\/3178876.3186098-1","unstructured":"Online. 800notes - Directory of UNKNOWN Callers. http:\/\/800notes.com\/. (Online)."},{"key":"key-10.1145\/3178876.3186098-2","unstructured":"Online. abuse.ch - the swiss security blog. https:\/\/www.abuse.ch\/. (Online)."},{"key":"key-10.1145\/3178876.3186098-3","unstructured":"Online. Active DNS Project. https:\/\/www.activednsproject.org\/. (Online)."},{"key":"key-10.1145\/3178876.3186098-4","unstructured":"Online. Alexa Topsites. http:\/\/www.alexa.com\/topsites. (Online)."},{"key":"key-10.1145\/3178876.3186098-5","unstructured":"Online. Bad Ads Trend Alert: Shining a Light on Tech Support Advertising Scams. http:\/\/bit.ly\/2y2rbnq. (Online)."},{"key":"key-10.1145\/3178876.3186098-6","unstructured":"Online. BeautifulSoup. https:\/\/pypi.python.org\/pypi\/beautifulsoup4. (Online)."},{"key":"key-10.1145\/3178876.3186098-7","unstructured":"Online. Bing Ads bans ads from third-party tech support services. http:\/\/search engineland.com\/bing-bans-third-party-tech-support-ads-249356. (Online)."},{"key":"key-10.1145\/3178876.3186098-8","unstructured":"Online. Bing brings in blanket ban on online tech support ads. https:\/\/goo.gl\/6b gPFF. (Online)."},{"key":"key-10.1145\/3178876.3186098-9","unstructured":"Online. Bing Search API. http:\/\/datamarket.azure.com\/dataset\/bing\/search. (Online)."},{"key":"key-10.1145\/3178876.3186098-10","unstructured":"Online. Block search indexing with 'noindex'. https:\/\/support.google.com\/web masters\/answer\/93710?hl=en. (Online)."},{"key":"key-10.1145\/3178876.3186098-11","unstructured":"Online. FTC - Tech Support Scams. http:\/\/bit.ly\/1XIF9RV. (Online)."},{"key":"key-10.1145\/3178876.3186098-12","unstructured":"Online. FTC Charges Tech Support Companies With Using Deceptive Pop-Up Ads to Scare Consumers Into Purchasing Unneeded Services. https:\/\/www.ftc.gov\/news-events\/press-releases\/2016\/10\/ftc-charges-t ech-support-companies-using-deceptive-pop-ads-scare. (Online)."},{"key":"key-10.1145\/3178876.3186098-13","unstructured":"Online. FTC Obtains Settlements from Operators of Tech Support Scams. https:\/\/www.ftc.gov\/news-events\/press-releases\/2017\/10\/ftc-obtains-set tlements-operators-tech-support-scams. (Online)."},{"key":"key-10.1145\/3178876.3186098-14","unstructured":"Online. Geek Squad Services - Best Buy. https:\/\/goo.gl\/s7lWlq. (Online)."},{"key":"key-10.1145\/3178876.3186098-15","unstructured":"Online. Google Custom Search. https:\/\/goo.gl\/GyU7zP. (Online)."},{"key":"key-10.1145\/3178876.3186098-16","unstructured":"Online. Google Safe Browsing. https:\/\/goo.gl\/d1spJ. (Online)."},{"key":"key-10.1145\/3178876.3186098-17","unstructured":"Online. hphosts. http:\/\/www.hosts-file.net\/. (Online)."},{"key":"key-10.1145\/3178876.3186098-18","unstructured":"Online. Indian police arrest alleged ringleader of IRS scam. http:\/\/money.cnn.co m\/2017\/04\/09\/news\/tax-scam-india-arrest-ringleader\/. (Online)."},{"key":"key-10.1145\/3178876.3186098-19","unstructured":"Online. India's Call-Center Talents Put to a Criminal Use: Swindling Americans. http:\/\/nyti.ms\/2xpFv8C. (Online)."},{"key":"key-10.1145\/3178876.3186098-20","unstructured":"Online. I.T. Mate Product Support. http:\/\/support.it-mate.co.uk\/. (Online)."},{"key":"key-10.1145\/3178876.3186098-21","unstructured":"Online. Keyword Planner. https:\/\/adwords.google.com\/KeywordPlanner. (Online)."},{"key":"key-10.1145\/3178876.3186098-22","unstructured":"Online. Malc0de database. http:\/\/malc0de.com\/database\/. (Online)."},{"key":"key-10.1145\/3178876.3186098-23","unstructured":"Online. Malware Domain List. https:\/\/www.malwaredomainlist.com\/. (Online)."},{"key":"key-10.1145\/3178876.3186098-24","unstructured":"Online. Malwarebytes Lab. https:\/\/blog.malwarebytes.com\/tech-support-scams\/. (Online)."},{"key":"key-10.1145\/3178876.3186098-25","unstructured":"Online. N-Grams. http:\/\/stanford.io\/29zsjAy. (Online)."},{"key":"key-10.1145\/3178876.3186098-26","unstructured":"Online. PhantomJS. http:\/\/phantomjs.org\/. (Online)."},{"key":"key-10.1145\/3178876.3186098-27","unstructured":"Online. Python language bindings for Selenium WebDriver. https:\/\/pypi.python. org\/pypi\/selenium. (Online)."},{"key":"key-10.1145\/3178876.3186098-28","unstructured":"Online. sagadc summary. http:\/\/dns-bh.sagadc.org\/. (Online)."},{"key":"key-10.1145\/3178876.3186098-29","unstructured":"Online. Scare and sell: Here's how an Indian call centre cheated foreign computer owners. http:\/\/bit.ly\/2oj2Rpz. (Online)."},{"key":"key-10.1145\/3178876.3186098-30","unstructured":"Online. Searching For 'Facebook Customer Service' Can Lead To A Scam. http: \/\/n.pr\/2kex6vU. (Online)."},{"key":"key-10.1145\/3178876.3186098-31","unstructured":"Online. SPAMHaus Blocklist. https:\/\/www.spamhaus.org\/lookup\/. (Online)."},{"key":"key-10.1145\/3178876.3186098-32","unstructured":"Online. Suspicious domains - sans internet storm center. https:\/\/isc.sans.edu\/sus picious_domains.html. (Online)."},{"key":"key-10.1145\/3178876.3186098-33","unstructured":"Online. Tech support scams persist with increasingly crafty techniques. https: \/\/goo.gl\/cHHPDI. (Online)."},{"key":"key-10.1145\/3178876.3186098-34","unstructured":"Online. Tech support scams remain at the top of the list of bad actors that search engines have to keep fighting. http:\/\/selnd.com\/24jskRr. (Online)."},{"key":"key-10.1145\/3178876.3186098-35","unstructured":"Online. Two Massive Tech Support Scams Shutdown by State of Florida, FTC. https:\/\/trustinads.org\/2014\/11\/two-massive-tech-support-scams-shutd own-by-state-of-florida-f tc\/. (Online)."},{"key":"key-10.1145\/3178876.3186098-36","unstructured":"Online. VirusTotal. https:\/\/www.virustotal.com\/. (Online)."},{"key":"key-10.1145\/3178876.3186098-37","unstructured":"David S Anderson, Chris Fleizach, Stefan Savage, and Geoffrey M Voelker. Spamscatter: Characterizing internet scam hosting infrastructure."},{"key":"key-10.1145\/3178876.3186098-38","unstructured":"Manos Antonakakis, Roberto Perdisci, David Dagon, Wenke Lee, and Nick Feamster. USENIX Security 2010. Building a Dynamic Reputation System for DNS."},{"key":"key-10.1145\/3178876.3186098-39","unstructured":"Leyla Bilge, Engin Kirda, Christopher Kruegel, and Marco Balduzzi. NDSS 2011. EXPOSURE: Finding Malicious Domains Using Passive DNS Analysis."},{"key":"key-10.1145\/3178876.3186098-40","doi-asserted-by":"crossref","unstructured":"Nathaniel Boggs, Wei Wang, Suhas Mathur, Baris Coskun, and Carol Pincock. ACSAC 2013. Discovery of Emergent Malicious Campaigns in Cellular Networks.","DOI":"10.1145\/2523649.2523657"},{"key":"key-10.1145\/3178876.3186098-41","doi-asserted-by":"crossref","unstructured":"Andrei Costin, Jelena Isacenkova, Marco Balduzzi, Aurélien Francillon, and Davide Balzarotti. International Conference on Privacy, Security and Trust (PST) 2013. The role of phone numbers in understanding cyber-crime schemes.","DOI":"10.1109\/PST.2013.6596056"},{"key":"key-10.1145\/3178876.3186098-42","doi-asserted-by":"crossref","unstructured":"Joe DeBlasio, Saikat Guha, Geoffrey M. Voelker, and Alex C. Snoeren. 2017. Exploring the Dynamics of Search Advertiser Fraud. In Proceedings of the 2017 Internet Measurement Conference (IMC '17). ACM, New York, NY, USA, 157--170. https:\/\/doi.org\/10.1145\/3131365.3131393","DOI":"10.1145\/3131365.3131393"},{"key":"key-10.1145\/3178876.3186098-43","doi-asserted-by":"crossref","unstructured":"Jr. Forney, G.D. 1973. The viterbi algorithm. Proc. IEEE 61, 3 (March 1973), 268--278. https:\/\/doi.org\/10.1109\/PROC.1973.9030","DOI":"10.1109\/PROC.1973.9030"},{"key":"key-10.1145\/3178876.3186098-44","doi-asserted-by":"crossref","unstructured":"Chris Grier, Kurt Thomas, Vern Paxson, and Chao Michael Zhang. ACM CCS 2010. @spam: the underground on 140 characters or less.","DOI":"10.1145\/1866307.1866311"},{"key":"key-10.1145\/3178876.3186098-45","doi-asserted-by":"crossref","unstructured":"Payas Gupta, Bharat Srinivasan, Vijay Balasubramaniyan, and Mustaque Ahamad. 2015. Phoneypot: Data-driven Understanding of Telephony Threats. In 22nd Annual Network and Distributed System Security Symposium, NDSS 2015, San Diego, California, USA, February 8--11, 2015. The Internet Society. http:\/\/bit.ly\/2wM1jff","DOI":"10.14722\/ndss.2015.23176"},{"key":"key-10.1145\/3178876.3186098-46","doi-asserted-by":"crossref","unstructured":"Jelena Isacenkova, Olivier Thonnard, Andrei Costin, Aurélien Francillon, and Davide Balzarotti. EURASIP J. Information Security 2014. Inside the SCAM Jungle: A Closer Look at 419 Scam Email Operations. (EURASIP J. Information Security 2014).","DOI":"10.1186\/1687-417X-2014-4"},{"key":"key-10.1145\/3178876.3186098-47","doi-asserted-by":"crossref","unstructured":"Nan Jiang, Yu Jin, Ann Skudlark, and Zhi-Li Zhang. USENIX Security 2013. Greystar: Fast and Accurate Detection of SMS Spam Numbers in Large Cellular Networks Using Grey Phone Space.","DOI":"10.1145\/2465529.2465530"},{"key":"key-10.1145\/3178876.3186098-48","unstructured":"Shalini Kapoor, Shachi Sharma, and Bharat Srinivasan. 2014. Clustering devices in an internet of things ('IoT'). (March 11 2014). US Patent 8,671,099."},{"key":"key-10.1145\/3178876.3186098-49","unstructured":"Shalini Kapoor, Shachi Sharma, and Bharat Ramakrishnan Srinivasan. 2013. Attribute-based identification schemes for objects in internet of things. (July 23 2013). US Patent 8,495,072."},{"key":"key-10.1145\/3178876.3186098-50","unstructured":"Nektarios Leontiadis, Tyler Moore, and Nicolas Christin. USENIX Security 2011. Measuring and Analyzing Search-redirection Attacks in the Illicit Online Prescription Drug Trade."},{"key":"key-10.1145\/3178876.3186098-51","doi-asserted-by":"crossref","unstructured":"Suqi Liu, Ian Foster, Stefan Savage, Geoffrey M. Voelker, and Lawrence K. Saul. 2015. Who is .Com?: Learning to Parse WHOIS Records. In Proceedings of the 2015 Internet Measurement Conference (IMC '15). ACM.","DOI":"10.1145\/2815675.2815693"},{"key":"key-10.1145\/3178876.3186098-52","unstructured":"Christopher D Manning and Hinrich Schütze. 1999. Foundations of statistical natural language processing. Vol. 999. MIT Press."},{"key":"key-10.1145\/3178876.3186098-53","doi-asserted-by":"crossref","unstructured":"Najmeh Miramirkhani, Oleksii Starov, and Nick Nikiforakis. NDSS 2017. Dial One for Scam: A Large-Scale Analysis of Technical Support Scams.","DOI":"10.14722\/ndss.2017.23163"},{"key":"key-10.1145\/3178876.3186098-54","doi-asserted-by":"crossref","unstructured":"Tyler Moore and Richard Clayton. 2007. Examining the impact of website takedown on phishing. In Proceedings of the anti-phishing working groups 2nd annual eCrime researchers summit. ACM, 1--13.","DOI":"10.1145\/1299015.1299016"},{"key":"key-10.1145\/3178876.3186098-55","unstructured":"Marti Motoyama, Kirill Levchenko, Chris Kanich, Damon McCoy, Geoffrey M Voelker, and Stefan Savage. 2010. Re: CAPTCHAs-Understanding CAPTCHASolving Services in an Economic Context.. In USENIX Security Symposium."},{"key":"key-10.1145\/3178876.3186098-56","doi-asserted-by":"crossref","unstructured":"Ilona Murynets and Roger Piqueras Jover. IMC 2012. Crime scene investigation: SMS spam data analysis.","DOI":"10.1145\/2398776.2398822"},{"key":"key-10.1145\/3178876.3186098-57","doi-asserted-by":"crossref","unstructured":"Youngsam Park, Jackie Jones, Damon McCoy, Elaine Shi, and Markus Jakobsson. NDSS 2014. Scambaiter: Understanding targeted nigerian scams on craigslist.","DOI":"10.14722\/ndss.2014.23284"},{"key":"key-10.1145\/3178876.3186098-58","unstructured":"Dan Pelleg, Andrew W Moore, et al. ICML 2000. X-means: Extending K-means with Efficient Estimation of the Number of Clusters."},{"key":"key-10.1145\/3178876.3186098-59","unstructured":"Iasonas Polakis, Thanasis Petsas, Evangelos P. Markatos, and Spyros Antonatos. NDSS 2010. A Systematic Characterization of IM Threats using Honeypots."},{"key":"key-10.1145\/3178876.3186098-60","unstructured":"Merve Sahin, Marc Relieu, and Aurélien Francillon. SOUPS 2017. Using chatbots against voice spam: Analyzing Lenny effectiveness."},{"key":"key-10.1145\/3178876.3186098-61","unstructured":"Gerard Salton and Michael J. McGill. 1986. Introduction to Modern Information Retrieval. McGraw-Hill, Inc., New York, NY, USA."},{"key":"key-10.1145\/3178876.3186098-62","unstructured":"Shachi Sharma, Shalini Kapoor, Bharat R. Srinivasan, and Mayank S. Narula. 2011. HiCHO: Attributes Based Classification of Ubiquitous Devices. In Mobile and Ubiquitous Systems: Computing, Networking, and Services - 8th International ICST Conference, MobiQuitous 2011, Copenhagen, Denmark, December 6--9, 2011, Revised Selected Papers (Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering), Alessandro Puiatti and Tao Gu (Eds.), Vol. 104. Springer, 113--125. https:\/\/doi.org\/10.1007\/978--3--642--30973--1_10"},{"key":"key-10.1145\/3178876.3186098-63","doi-asserted-by":"crossref","unstructured":"Craig A. Shue, Andrew J. Kalafut, and Minaxi Gupta. 2007. The Web is Smaller Than It Seems. In Proceedings of the 7th ACM SIGCOMM Conference on Internet Measurement (IMC '07). ACM, New York, NY, USA, 123--128. https:\/\/doi.org\/10. 1145\/1298306.1298324","DOI":"10.1145\/1298306.1298324"},{"key":"key-10.1145\/3178876.3186098-64","unstructured":"Kyle Soska and Nicolas Christin. USENIX Security 2015. Measuring the Longitudinal Evolution of the Online Anonymous Marketplace Ecosystem."},{"key":"key-10.1145\/3178876.3186098-65","unstructured":"Bharat Srinivasan, Payas Gupta, Manos Antonakakis, and Mustaque Ahamad. 2016. Understanding Cross-Channel Abuse with SMS-Spam Support Infrastructure Attribution. In Computer Security - ESORICS 2016 - 21st European Symposium on Research in Computer Security, Heraklion, Greece, September 26--30, 2016, Proceedings, Part I (Lecture Notes in Computer Science), Ioannis G. Askoxylakis, Sotiris Ioannidis, Sokratis K. Katsikas, and Catherine A. Meadows (Eds.), Vol. 9878. Springer, 3--26. https:\/\/doi.org\/10.1007\/978--3--319--45744--4_1"},{"key":"key-10.1145\/3178876.3186098-66","unstructured":"Bharat Ramakrishnan Srinivasan. 2017. Exposing and Mitigating Cross-Channel Abuse that Exploits the Converged Communications Infrastructure. Ph.D. Dissertation. Georgia Institute of Technology."},{"key":"key-10.1145\/3178876.3186098-67","doi-asserted-by":"crossref","unstructured":"Kurt Thomas, Chris Grier, Justin Ma, Vern Paxson, and Dawn Song. IEEE Symposium on Security and Privacy 2011. Design and Evaluation of a Real-Time URL Spam Filtering Service.","DOI":"10.1109\/SP.2011.25"},{"key":"key-10.1145\/3178876.3186098-68","doi-asserted-by":"crossref","unstructured":"Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier, and Damon McCoy. ACM CCS 2014. Dialing back abuse on phone verified accounts.","DOI":"10.1145\/2660267.2660321"},{"key":"key-10.1145\/3178876.3186098-69","unstructured":"Michael E Wall, Andreas Rechtsteiner, and Luis M Rocha. 2003. Singular value decomposition and principal component analysis. In A practical approach to microarray data analysis. Springer, 91--109."}],"event":{"number":"2018","sponsor":["SIGWEB, ACM Special Interest Group on Hypertext, Hypermedia, and Web","IW3C2, International World Wide Web Conference Committee"],"acronym":"WWW '18","name":"the 2018 World Wide Web Conference","start":{"date-parts":[[2018,4,23]]},"location":"Lyon, France","end":{"date-parts":[[2018,4,27]]}},"container-title":["Proceedings of the 2018 World Wide Web Conference on World Wide Web - WWW '18"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3178876.3186098","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/dl.acm.org\/ft_gateway.cfm?id=3186098&ftid=1957484&dwn=1","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T02:11:28Z","timestamp":1750212688000},"score":1,"resource":{"primary":{"URL":"http:\/\/dl.acm.org\/citation.cfm?doid=3178876.3186098"}},"subtitle":[],"proceedings-subject":"World Wide Web","short-title":[],"issued":{"date-parts":[[2018]]},"references-count":69,"URL":"https:\/\/doi.org\/10.1145\/3178876.3186098","relation":{},"subject":[],"published":{"date-parts":[[2018]]}}}