Uncovering Black-hat SEO based fake E-commerce scam groups from their redirectors and websites

TL;DR

This paper tackles fake E-commerce scams that use black-hat SEO via redirectors to drive users to fraudulent sites. It leverages a large JC3 dataset of 692,865 fake EC sites collected over 2.5 years and applies Maltego-based link analysis plus tailored scripting to identify threat actor groups and their dynamics through time-series analysis. The study identifies 17 sizable groups and demonstrates how group-level analysis can reveal the evolution of attack campaigns, including a case study linking a refund-scam tactic to multiple groups. By providing a group-centric view of black-hat SEO-driven scams, the work offers actionable insights for law enforcement and security researchers to monitor, attribute, and counter these threats.

Abstract

While law enforcements agencies and cybercrime researchers are working hard, fake E-commerce scam is still a big threat to Internet users. One of the major techniques to victimize users is luring them by black-hat search-engine-optimization (SEO); making search engines display their lure pages as if these were placed on compromised websites and then redirecting visitors to malicious sites. In this study, we focus on the threat actors conduct fake E-commerce scam with this strategy. Our previous study looked at the connection between some malware families used for black-hat SEO to enlighten threat actors and their infrastructures, however it shows only a limited part of the whole picture because we could not find all SEO malware samples from limited sources. In this paper, we aim to identify and analyze threat actor groups using a large dataset of fake E-commerce sites collected by Japan Cybercrime Control Center, which we believe is of higher quality. It includes 692,865 fake EC sites gathered from redirectors over two and a half years, from May 20, 2022 to Dec. 31, 2024. We analyzed the links between these sites using Maltego, a well-known link analysis tool, and tailored programs. We also conducted time series analysis to track group changes in the groups. According to the analysis, we estimate that 17 relatively large groups were active during the dataset period and some of them were active throughout the period.

Figures (6)

• Figure 1: Entity connections to create a Maltego graph for link analysis
• Figure 2: A maltego graph shows relationship of fake EC sites
• Figure 3: Time-chart of fake EC domains in subgroups of G1
• Figure 4: Time-chart of fake EC domains in subgroups of G2.
• Figure 5: Time-chart of fake EC domains in subgroups of G3.