SlideShare a Scribd company logo
Inside the SCAM Jungle:
A Closer Look at 419 Scam Email Operations
Jelena Isacenkova
Olivier Thonard
Andrei Costin
Aurelien Francillon
Davide Balzarotti
2
Nigerian Scam Trap
3
Nigerian Scam Trap
4
Spam vs. 419 Scam
419 SCAM
―
Low-volume
―
Hide behind webmail accounts
―
Manual sending
― Trap with social engineering techniques
―
Contact with victims via emails and/or
phone numbers
SPAM
―
High-volume
―
Highly dynamic infrastructure
― Automated sending
―
Trap victims through engineering effort
―
Contact with victims over URLs
5
Why we study campaigns
― The goal:
– identify and characterize 419 scam campaigns
– find predictive scam email features
―
Our assumptions:
– Scam is likely sent in campaigns, like Spam
– Emails and phone numbers are personal scammer assets (Costin
et al., PST'13) => linking features
6
Outline
― Dataset
― Methodology
―
Experimental results
― Conclusions
7
Dataset
8
Dataset
― Public data from 419scam.org
― From January 2009 till August 2012
―
36,761 scam messages
― 12 countries (Europe, Africa and Asia)
― 34,723 unique email addresses
― 11,738 unique phone numbers
9
Scam origins by phone numbers
10
Scam origins by phone numbers
Nigeria – 30%
Benin – 14%
South Africa – 5%
11
Scam origins by phone numbers
UK
Personal Numbering Services
(PNS)
Nigeria – 30%
Benin – 14%
South Africa – 5%
12
Scam origins by phone numbers
UK
Personal Numbering Services
(PNS)
Nigeria – 30%
Benin – 14%
South Africa – 5%
Spain – 4%
Netherlands – 3%
13
Data categories
14
Methodology
15
TRIAGE
― Security data mining framework (Thonnard et al. at RAID'10,
CEAS'11, RAID'12)
― Multi-dimentional clustering
― Links common elements together forming clusters/campaigns
16
TRIAGE, part 2
17
Experimental results
18
Campaigns
― 1,040 campaigns identified, with at least 5 messages each
―
Top 250 campaigns on average:
– Long and scarce: last for one year and have only 28 active days
– Small (38 emails): keep low-volume, could be unorganized
– Use 2 phone numbers
– Use 6 Reply-To email addresses
– Use 14 From email addresses
19
Re-use of emails and phones
20
Re-use of emails and phones
Being re-used on average 6 months
Being re-used on average 2,5 months
21
Examples
22
23
Main traits:
Single phone number
Two campaign topics
Long lived
83 emails
24
Fake lottery
1 year
“Eskom generates approximately 95%
of the electricity used in South Africa
and approximately 45% of the electricity
used in Africa.”, - Escom
Different topics over time
Main traits:
Topics change
Monthly package of emails
Single phone number
58 emails
Different topics over time
Main traits:
Topics change
Monthly package of emails
Single phone number
58 emails November
December
January
February
March
iPhone campaign
Main traits:
One topic
Two phone numbers
Big re-used email package
190 emails
29
Macro-clusters
― Link strongly connected clusters into loosely connected
― Linked through emails and/or phone numbers
― 62 macro-clusters, 195 inter-connected clusters
30
Top macro-clusters
― Some are organized groups operating on international scale
―
Fake lottery scam is primarily run by scammers located in Europe that are
connected with African scammer groups
31
Clusters by countries
― Majority of unclustered data
present isolated African
actors => unorganized
― Macro-clusters cover
African and many European
actors => bigger organized
groups covering Western
markets
32
Clusters by countries
Unclustered:
stealthy or isolated scammers ― Majority of unclustered data
present isolated African
actors => unorganized
― Macro-clusters cover
African and many European
actors => bigger organized
groups covering Western
markets
33
Clusters by countries
Unclustered:
stealthy or isolated scammers ― Majority of unclustered data
present isolated African
actors => unorganized
― Macro-clusters cover
African and many European
actors => bigger organized
groups covering Western
markets
Organized
35
Conclusions
Emails and phone numbers play a crucial role in Nigerian email scam
– Campaigns are long and scarce
– Scammers hide behind webmail and forwarded phones
– Scam campaigns differ in their infrastructure, orchestration and modus
operandi
– Different scammers probably compete for trendy topics, thus changing topics
over time
36

More Related Content

Similar to A Closer Look at 419 Scam Email Operations

SplunkLive! Utrecht 2018 - Customer presentation: POST Luxembourg
SplunkLive! Utrecht 2018 - Customer presentation: POST Luxembourg SplunkLive! Utrecht 2018 - Customer presentation: POST Luxembourg
SplunkLive! Utrecht 2018 - Customer presentation: POST Luxembourg
Splunk
 
Business under cyberassault
Business under cyberassaultBusiness under cyberassault
Business under cyberassault
Mohammad Husain
 
CYBER CRIME AND SECURITY
CYBER CRIME AND SECURITYCYBER CRIME AND SECURITY
CYBER CRIME AND SECURITY
Chaya Sorir
 
Why Your Finance Firm Must Monitor For Stolen Accounts
Why Your Finance Firm Must Monitor For Stolen AccountsWhy Your Finance Firm Must Monitor For Stolen Accounts
Why Your Finance Firm Must Monitor For Stolen Accounts
David McHale
 
CS 1.ppt
CS 1.pptCS 1.ppt
CS 1.ppt
JAYANTHKUMARTM
 
Phishing & spamming
Phishing & spammingPhishing & spamming
Phishing & spamming
Kavis Pandey
 
Seminar
SeminarSeminar
Seminar
Kavis Pandey
 
Cyber Crime, Cyber Space and Effects .pptx
Cyber Crime, Cyber Space and Effects .pptxCyber Crime, Cyber Space and Effects .pptx
Cyber Crime, Cyber Space and Effects .pptx
SahilMishra81
 
Cyber Crime Cyber Space and Effects .pptx
Cyber Crime Cyber Space and Effects .pptxCyber Crime Cyber Space and Effects .pptx
Cyber Crime Cyber Space and Effects .pptx
SahilMishra81
 
2.Cyber law and Crime.pptx
2.Cyber law and Crime.pptx2.Cyber law and Crime.pptx
2.Cyber law and Crime.pptx
Sanil Shrivastava
 
Using Technology and People to Improve your Threat Resistance and Cyber Security
Using Technology and People to Improve your Threat Resistance and Cyber SecurityUsing Technology and People to Improve your Threat Resistance and Cyber Security
Using Technology and People to Improve your Threat Resistance and Cyber Security
Stephen Cobb
 
Identifying and Mitigating Cross-Platform Phone Number Abuse on Social Channels
Identifying and Mitigating Cross-Platform Phone Number Abuse on Social ChannelsIdentifying and Mitigating Cross-Platform Phone Number Abuse on Social Channels
Identifying and Mitigating Cross-Platform Phone Number Abuse on Social Channels
IIIT Hyderabad
 

Similar to A Closer Look at 419 Scam Email Operations (12)

SplunkLive! Utrecht 2018 - Customer presentation: POST Luxembourg
SplunkLive! Utrecht 2018 - Customer presentation: POST Luxembourg SplunkLive! Utrecht 2018 - Customer presentation: POST Luxembourg
SplunkLive! Utrecht 2018 - Customer presentation: POST Luxembourg
 
Business under cyberassault
Business under cyberassaultBusiness under cyberassault
Business under cyberassault
 
CYBER CRIME AND SECURITY
CYBER CRIME AND SECURITYCYBER CRIME AND SECURITY
CYBER CRIME AND SECURITY
 
Why Your Finance Firm Must Monitor For Stolen Accounts
Why Your Finance Firm Must Monitor For Stolen AccountsWhy Your Finance Firm Must Monitor For Stolen Accounts
Why Your Finance Firm Must Monitor For Stolen Accounts
 
CS 1.ppt
CS 1.pptCS 1.ppt
CS 1.ppt
 
Phishing & spamming
Phishing & spammingPhishing & spamming
Phishing & spamming
 
Seminar
SeminarSeminar
Seminar
 
Cyber Crime, Cyber Space and Effects .pptx
Cyber Crime, Cyber Space and Effects .pptxCyber Crime, Cyber Space and Effects .pptx
Cyber Crime, Cyber Space and Effects .pptx
 
Cyber Crime Cyber Space and Effects .pptx
Cyber Crime Cyber Space and Effects .pptxCyber Crime Cyber Space and Effects .pptx
Cyber Crime Cyber Space and Effects .pptx
 
2.Cyber law and Crime.pptx
2.Cyber law and Crime.pptx2.Cyber law and Crime.pptx
2.Cyber law and Crime.pptx
 
Using Technology and People to Improve your Threat Resistance and Cyber Security
Using Technology and People to Improve your Threat Resistance and Cyber SecurityUsing Technology and People to Improve your Threat Resistance and Cyber Security
Using Technology and People to Improve your Threat Resistance and Cyber Security
 
Identifying and Mitigating Cross-Platform Phone Number Abuse on Social Channels
Identifying and Mitigating Cross-Platform Phone Number Abuse on Social ChannelsIdentifying and Mitigating Cross-Platform Phone Number Abuse on Social Channels
Identifying and Mitigating Cross-Platform Phone Number Abuse on Social Channels
 

Recently uploaded

Methods of grain storage Structures in India.pdf
Methods of grain storage Structures in India.pdfMethods of grain storage Structures in India.pdf
Methods of grain storage Structures in India.pdf
PirithiRaju
 
Anti-Universe And Emergent Gravity and the Dark Universe
Anti-Universe And Emergent Gravity and the Dark UniverseAnti-Universe And Emergent Gravity and the Dark Universe
Anti-Universe And Emergent Gravity and the Dark Universe
Sérgio Sacani
 
JAMES WEBB STUDY THE MASSIVE BLACK HOLE SEEDS
JAMES WEBB STUDY THE MASSIVE BLACK HOLE SEEDSJAMES WEBB STUDY THE MASSIVE BLACK HOLE SEEDS
JAMES WEBB STUDY THE MASSIVE BLACK HOLE SEEDS
Sérgio Sacani
 
Discovery of An Apparent Red, High-Velocity Type Ia Supernova at 𝐳 = 2.9 wi...
Discovery of An Apparent Red, High-Velocity Type Ia Supernova at  𝐳 = 2.9  wi...Discovery of An Apparent Red, High-Velocity Type Ia Supernova at  𝐳 = 2.9  wi...
Discovery of An Apparent Red, High-Velocity Type Ia Supernova at 𝐳 = 2.9 wi...
Sérgio Sacani
 
Compexometric titration/Chelatorphy titration/chelating titration
Compexometric titration/Chelatorphy titration/chelating titrationCompexometric titration/Chelatorphy titration/chelating titration
Compexometric titration/Chelatorphy titration/chelating titration
Vandana Devesh Sharma
 
在线办理(salfor毕业证书)索尔福德大学毕业证毕业完成信一模一样
在线办理(salfor毕业证书)索尔福德大学毕业证毕业完成信一模一样在线办理(salfor毕业证书)索尔福德大学毕业证毕业完成信一模一样
在线办理(salfor毕业证书)索尔福德大学毕业证毕业完成信一模一样
vluwdy49
 
Sciences of Europe journal No 142 (2024)
Sciences of Europe journal No 142 (2024)Sciences of Europe journal No 142 (2024)
Sciences of Europe journal No 142 (2024)
Sciences of Europe
 
快速办理(UAM毕业证书)马德里自治大学毕业证学位证一模一样
快速办理(UAM毕业证书)马德里自治大学毕业证学位证一模一样快速办理(UAM毕业证书)马德里自治大学毕业证学位证一模一样
快速办理(UAM毕业证书)马德里自治大学毕业证学位证一模一样
hozt8xgk
 
CLASS 12th CHEMISTRY SOLID STATE ppt (Animated)
CLASS 12th CHEMISTRY SOLID STATE ppt (Animated)CLASS 12th CHEMISTRY SOLID STATE ppt (Animated)
CLASS 12th CHEMISTRY SOLID STATE ppt (Animated)
eitps1506
 
Microbiology of Central Nervous System INFECTIONS.pdf
Microbiology of Central Nervous System INFECTIONS.pdfMicrobiology of Central Nervous System INFECTIONS.pdf
Microbiology of Central Nervous System INFECTIONS.pdf
sammy700571
 
Pests of Storage_Identification_Dr.UPR.pdf
Pests of Storage_Identification_Dr.UPR.pdfPests of Storage_Identification_Dr.UPR.pdf
Pests of Storage_Identification_Dr.UPR.pdf
PirithiRaju
 
Juaristi, Jon. - El canon espanol. El legado de la cultura española a la civi...
Juaristi, Jon. - El canon espanol. El legado de la cultura española a la civi...Juaristi, Jon. - El canon espanol. El legado de la cultura española a la civi...
Juaristi, Jon. - El canon espanol. El legado de la cultura española a la civi...
frank0071
 
LEARNING TO LIVE WITH LAWS OF MOTION .pptx
LEARNING TO LIVE WITH LAWS OF MOTION .pptxLEARNING TO LIVE WITH LAWS OF MOTION .pptx
LEARNING TO LIVE WITH LAWS OF MOTION .pptx
yourprojectpartner05
 
Farming systems analysis: what have we learnt?.pptx
Farming systems analysis: what have we learnt?.pptxFarming systems analysis: what have we learnt?.pptx
Farming systems analysis: what have we learnt?.pptx
Frédéric Baudron
 
Gadgets for management of stored product pests_Dr.UPR.pdf
Gadgets for management of stored product pests_Dr.UPR.pdfGadgets for management of stored product pests_Dr.UPR.pdf
Gadgets for management of stored product pests_Dr.UPR.pdf
PirithiRaju
 
The debris of the ‘last major merger’ is dynamically young
The debris of the ‘last major merger’ is dynamically youngThe debris of the ‘last major merger’ is dynamically young
The debris of the ‘last major merger’ is dynamically young
Sérgio Sacani
 
HUMAN EYE By-R.M Class 10 phy best digital notes.pdf
HUMAN EYE By-R.M Class 10 phy best digital notes.pdfHUMAN EYE By-R.M Class 10 phy best digital notes.pdf
HUMAN EYE By-R.M Class 10 phy best digital notes.pdf
Ritik83251
 
Summary Of transcription and Translation.pdf
Summary Of transcription and Translation.pdfSummary Of transcription and Translation.pdf
Summary Of transcription and Translation.pdf
vadgavevedant86
 
Mending Clothing to Support Sustainable Fashion_CIMaR 2024.pdf
Mending Clothing to Support Sustainable Fashion_CIMaR 2024.pdfMending Clothing to Support Sustainable Fashion_CIMaR 2024.pdf
Mending Clothing to Support Sustainable Fashion_CIMaR 2024.pdf
Selcen Ozturkcan
 
fermented food science of sauerkraut.pptx
fermented food science of sauerkraut.pptxfermented food science of sauerkraut.pptx
fermented food science of sauerkraut.pptx
ananya23nair
 

Recently uploaded (20)

Methods of grain storage Structures in India.pdf
Methods of grain storage Structures in India.pdfMethods of grain storage Structures in India.pdf
Methods of grain storage Structures in India.pdf
 
Anti-Universe And Emergent Gravity and the Dark Universe
Anti-Universe And Emergent Gravity and the Dark UniverseAnti-Universe And Emergent Gravity and the Dark Universe
Anti-Universe And Emergent Gravity and the Dark Universe
 
JAMES WEBB STUDY THE MASSIVE BLACK HOLE SEEDS
JAMES WEBB STUDY THE MASSIVE BLACK HOLE SEEDSJAMES WEBB STUDY THE MASSIVE BLACK HOLE SEEDS
JAMES WEBB STUDY THE MASSIVE BLACK HOLE SEEDS
 
Discovery of An Apparent Red, High-Velocity Type Ia Supernova at 𝐳 = 2.9 wi...
Discovery of An Apparent Red, High-Velocity Type Ia Supernova at  𝐳 = 2.9  wi...Discovery of An Apparent Red, High-Velocity Type Ia Supernova at  𝐳 = 2.9  wi...
Discovery of An Apparent Red, High-Velocity Type Ia Supernova at 𝐳 = 2.9 wi...
 
Compexometric titration/Chelatorphy titration/chelating titration
Compexometric titration/Chelatorphy titration/chelating titrationCompexometric titration/Chelatorphy titration/chelating titration
Compexometric titration/Chelatorphy titration/chelating titration
 
在线办理(salfor毕业证书)索尔福德大学毕业证毕业完成信一模一样
在线办理(salfor毕业证书)索尔福德大学毕业证毕业完成信一模一样在线办理(salfor毕业证书)索尔福德大学毕业证毕业完成信一模一样
在线办理(salfor毕业证书)索尔福德大学毕业证毕业完成信一模一样
 
Sciences of Europe journal No 142 (2024)
Sciences of Europe journal No 142 (2024)Sciences of Europe journal No 142 (2024)
Sciences of Europe journal No 142 (2024)
 
快速办理(UAM毕业证书)马德里自治大学毕业证学位证一模一样
快速办理(UAM毕业证书)马德里自治大学毕业证学位证一模一样快速办理(UAM毕业证书)马德里自治大学毕业证学位证一模一样
快速办理(UAM毕业证书)马德里自治大学毕业证学位证一模一样
 
CLASS 12th CHEMISTRY SOLID STATE ppt (Animated)
CLASS 12th CHEMISTRY SOLID STATE ppt (Animated)CLASS 12th CHEMISTRY SOLID STATE ppt (Animated)
CLASS 12th CHEMISTRY SOLID STATE ppt (Animated)
 
Microbiology of Central Nervous System INFECTIONS.pdf
Microbiology of Central Nervous System INFECTIONS.pdfMicrobiology of Central Nervous System INFECTIONS.pdf
Microbiology of Central Nervous System INFECTIONS.pdf
 
Pests of Storage_Identification_Dr.UPR.pdf
Pests of Storage_Identification_Dr.UPR.pdfPests of Storage_Identification_Dr.UPR.pdf
Pests of Storage_Identification_Dr.UPR.pdf
 
Juaristi, Jon. - El canon espanol. El legado de la cultura española a la civi...
Juaristi, Jon. - El canon espanol. El legado de la cultura española a la civi...Juaristi, Jon. - El canon espanol. El legado de la cultura española a la civi...
Juaristi, Jon. - El canon espanol. El legado de la cultura española a la civi...
 
LEARNING TO LIVE WITH LAWS OF MOTION .pptx
LEARNING TO LIVE WITH LAWS OF MOTION .pptxLEARNING TO LIVE WITH LAWS OF MOTION .pptx
LEARNING TO LIVE WITH LAWS OF MOTION .pptx
 
Farming systems analysis: what have we learnt?.pptx
Farming systems analysis: what have we learnt?.pptxFarming systems analysis: what have we learnt?.pptx
Farming systems analysis: what have we learnt?.pptx
 
Gadgets for management of stored product pests_Dr.UPR.pdf
Gadgets for management of stored product pests_Dr.UPR.pdfGadgets for management of stored product pests_Dr.UPR.pdf
Gadgets for management of stored product pests_Dr.UPR.pdf
 
The debris of the ‘last major merger’ is dynamically young
The debris of the ‘last major merger’ is dynamically youngThe debris of the ‘last major merger’ is dynamically young
The debris of the ‘last major merger’ is dynamically young
 
HUMAN EYE By-R.M Class 10 phy best digital notes.pdf
HUMAN EYE By-R.M Class 10 phy best digital notes.pdfHUMAN EYE By-R.M Class 10 phy best digital notes.pdf
HUMAN EYE By-R.M Class 10 phy best digital notes.pdf
 
Summary Of transcription and Translation.pdf
Summary Of transcription and Translation.pdfSummary Of transcription and Translation.pdf
Summary Of transcription and Translation.pdf
 
Mending Clothing to Support Sustainable Fashion_CIMaR 2024.pdf
Mending Clothing to Support Sustainable Fashion_CIMaR 2024.pdfMending Clothing to Support Sustainable Fashion_CIMaR 2024.pdf
Mending Clothing to Support Sustainable Fashion_CIMaR 2024.pdf
 
fermented food science of sauerkraut.pptx
fermented food science of sauerkraut.pptxfermented food science of sauerkraut.pptx
fermented food science of sauerkraut.pptx
 

A Closer Look at 419 Scam Email Operations

  • 1. Inside the SCAM Jungle: A Closer Look at 419 Scam Email Operations Jelena Isacenkova Olivier Thonard Andrei Costin Aurelien Francillon Davide Balzarotti
  • 4. 4 Spam vs. 419 Scam 419 SCAM ― Low-volume ― Hide behind webmail accounts ― Manual sending ― Trap with social engineering techniques ― Contact with victims via emails and/or phone numbers SPAM ― High-volume ― Highly dynamic infrastructure ― Automated sending ― Trap victims through engineering effort ― Contact with victims over URLs
  • 5. 5 Why we study campaigns ― The goal: – identify and characterize 419 scam campaigns – find predictive scam email features ― Our assumptions: – Scam is likely sent in campaigns, like Spam – Emails and phone numbers are personal scammer assets (Costin et al., PST'13) => linking features
  • 8. 8 Dataset ― Public data from 419scam.org ― From January 2009 till August 2012 ― 36,761 scam messages ― 12 countries (Europe, Africa and Asia) ― 34,723 unique email addresses ― 11,738 unique phone numbers
  • 9. 9 Scam origins by phone numbers
  • 10. 10 Scam origins by phone numbers Nigeria – 30% Benin – 14% South Africa – 5%
  • 11. 11 Scam origins by phone numbers UK Personal Numbering Services (PNS) Nigeria – 30% Benin – 14% South Africa – 5%
  • 12. 12 Scam origins by phone numbers UK Personal Numbering Services (PNS) Nigeria – 30% Benin – 14% South Africa – 5% Spain – 4% Netherlands – 3%
  • 15. 15 TRIAGE ― Security data mining framework (Thonnard et al. at RAID'10, CEAS'11, RAID'12) ― Multi-dimentional clustering ― Links common elements together forming clusters/campaigns
  • 18. 18 Campaigns ― 1,040 campaigns identified, with at least 5 messages each ― Top 250 campaigns on average: – Long and scarce: last for one year and have only 28 active days – Small (38 emails): keep low-volume, could be unorganized – Use 2 phone numbers – Use 6 Reply-To email addresses – Use 14 From email addresses
  • 19. 19 Re-use of emails and phones
  • 20. 20 Re-use of emails and phones Being re-used on average 6 months Being re-used on average 2,5 months
  • 22. 22
  • 23. 23 Main traits: Single phone number Two campaign topics Long lived 83 emails
  • 25. “Eskom generates approximately 95% of the electricity used in South Africa and approximately 45% of the electricity used in Africa.”, - Escom
  • 26. Different topics over time Main traits: Topics change Monthly package of emails Single phone number 58 emails
  • 27. Different topics over time Main traits: Topics change Monthly package of emails Single phone number 58 emails November December January February March
  • 28. iPhone campaign Main traits: One topic Two phone numbers Big re-used email package 190 emails
  • 29. 29 Macro-clusters ― Link strongly connected clusters into loosely connected ― Linked through emails and/or phone numbers ― 62 macro-clusters, 195 inter-connected clusters
  • 30. 30 Top macro-clusters ― Some are organized groups operating on international scale ― Fake lottery scam is primarily run by scammers located in Europe that are connected with African scammer groups
  • 31. 31 Clusters by countries ― Majority of unclustered data present isolated African actors => unorganized ― Macro-clusters cover African and many European actors => bigger organized groups covering Western markets
  • 32. 32 Clusters by countries Unclustered: stealthy or isolated scammers ― Majority of unclustered data present isolated African actors => unorganized ― Macro-clusters cover African and many European actors => bigger organized groups covering Western markets
  • 33. 33 Clusters by countries Unclustered: stealthy or isolated scammers ― Majority of unclustered data present isolated African actors => unorganized ― Macro-clusters cover African and many European actors => bigger organized groups covering Western markets Organized
  • 34.
  • 35. 35 Conclusions Emails and phone numbers play a crucial role in Nigerian email scam – Campaigns are long and scarce – Scammers hide behind webmail and forwarded phones – Scam campaigns differ in their infrastructure, orchestration and modus operandi – Different scammers probably compete for trendy topics, thus changing topics over time
  • 36. 36