为娱乐和利润而打字：弹出式骗局的跨国分析
Typosquatting for Fun and Profit: Cross-Country Analysis of Pop-Up Scam
摘要：
今天，许多不同类型的骗局可以在互联网上找到。网络犯罪分子总是在寻找新的创造性方法来欺骗互联网用户，无论是彩票诈骗，为智能手机下载诈骗应用程序还是假冒赌博网站。本文提出了一个大规模的研究，一个特殊的交付方式的在线骗局：弹出骗局的域名。Typosquatting描述了注册与现有域名非常相似的域名的概念，同时故意包含常见的打字错误;然后使用这些域名来欺骗在线用户，同时相信浏览预期的网站。弹出式骗局使用JavaScript警告框来呈现一条非常有效地吸引用户注意力的消息，因为它们是一个阻塞的用户界面元素。我们对来自Majestic Million列表的Typosquatting域的研究利用奥地利IP地址在1219个不同的Typosquatting URL上显示了总共2577个弹出消息，其中1538个是恶意的。这些不同的URL中大约有三分之一（403个）是有针对性的，只向一个特定的HTTP用户代理显示弹出消息。根据我们的扫描，我们对触发各种弹出窗口诈骗的不同目标参数（用户代理和语言）进行了深入分析和详细分类。此外，我们还阐述了当前弹出窗口诈骗特征与2018年底进行的先前扫描的差异，并检查了IDN同形异义词攻击的使用以及使用来自美国和日本的IP地址进行额外扫描的消息本地化应用。
英文摘要：
Today, many different types of scams can be found on the internet. Online criminals are always finding new creative ways to trick internet users, be it in the form of lottery scams, downloading scam apps for smartphones or fake gambling websites. This paper presents a large-scale study on one particular delivery method of online scam: pop-up scam on typosquatting domains. Typosquatting describes the concept of registering domains which are very similar to existing ones while deliberately containing common typing errors; these domains are then used to trick online users while under the belief of browsing the intended website. Pop-up scam uses JavaScript alert boxes to present a message which attracts the user's attention very effectively, as they are a blocking user interface element. Our study among typosquatting domains derived from the Majestic Million list utilising an Austrian IP address revealed on 1219 distinct typosquatting URLs a total of 2577 pop-up messages, out of which 1538 were malicious. Approximately a third of those distinct URLs (403) were targeted and displayed pop-up messages to one specific HTTP user agent only. Based on our scans, we present an in-depth analysis as well as a detailed classification of different targeting parameters (user agent and language) which triggered varying kinds of pop-up scams. Furthermore, we expound the differences of current pop-up scam characteristics in comparison with a previous scan performed in late 2018 and examine the use of IDN homograph attacks as well as the application of message localisation using additional scans with IP addresses from the United States and Japan.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
