Nearly 4,500 fake webshops taken down in 2019 following detection by SIDN

Working in tandem with the .nl registrars and other partners, SIDN got 4,340 fake webshops taken down in 2019. A large proportion of the fraudulent sites were detected using new self-learning tools developed by SIDN Labs. By continuously scanning .nl websites for characteristics associated with fraud, SIDN looks to get scams stopped as early as possible. The time that the domain name was registered and the e-mail address used for registration are two of the features looked at by the tools. As more and more data is gathered, the profiling characteristics used to identify suspect sites are constantly refined: the toolset effectively teaches itself how to recognise fakes. Prior to intervention, every webshop flagged up as suspicious is analysed by personnel in SIDN's Support Department so that bona fide webshops aren't shut down. Of the .nl websites examined between September and December, 79.3 per cent were confirmed as fakes. The self-learning capability of the algorithm means that new strategies adopted by fraudsters are picked up and addressed sooner.

Rapid development

Fake webshops are a serious headache for internet users; they swindle consumers out of large sums and undermine trust in the internet. SIDN Labs -- the research team of the Dutch national domain registry -- therefore invests considerable energy in tackling the problem. From years of experience, the team is acutely aware that the scammers are adapting all the time. "A while back, for example, fake webshops typically used long page titles that included multiple luxury brand names," says Thymen Wabeke, Research Engineer at SIDN Labs. "However, as soon as the crooks realised that long titles were one of the things our detection tool was looking for, they stopped using them." In pursuit of a constantly moving target, SIDN Labs is always improving its detection tools. Roughly nine website characteristics are currently analysed, most relating to the domain name registration process and the infrastructure used. They include the e-mail address linked to the registration, the time of registration and whether the domain name has a previous owner. "The timing is significant because a high proportion of fake webshops are registered during Chinese office hours," says Wabeke. "The re-registration of used domain names is another popular tactic with scammers. If a domain name is dropped by its user, it can be re-registered by someone else after forty days. And more than half of suspect domains turn out to have been re-registered as soon as the forty days were up." SIDN Labs has produced an academic article detailing how fake webshops operate and the efforts to tackle them. The article was recently accepted for publication at the prestigious Passive and Active Measurement Conference 2020.

Shutting down scam sites

A rigorous procedure is followed when dealing with suspect sites. If analysis by Customer Support confirms the tool's conclusions, the registrar used to register the domain name is alerted and asked to take down the site. In cases where a suspect site is linked to a domain name whose registrant details can't be confirmed within five days, SIDN is allowed to de-link the name server. That prevents anyone reaching the site by using that domain name.

Responsibility

In line with its commitment to the security and stability of the .nl domain, SIDN takes a proactive approach to tackling fake webshops. Although philosophical about eradication, CEO Roelof Meijer is determined to keep up the fight. "There will always be crooks, on the internet like anywhere else," he says. "But we firmly believe in doing all we can to make life difficult for them. So we're always refining our detection tools to make sure we're alert to new scamming tactics and able to counter them." Meijer also sees SIDN as having a unique responsibility. "As the registry for the .nl domain, we are the only ones who can do this work. Our role also means that we're in a position to take appropriate action. So we have a duty to do all we can. Our scanning and detection work is also yielding valuable knowledge that other countries can use. After all, fake webshops are by no means an exclusively Dutch problem." It's also important that consumers are on the lookout for tell-tale signs that a webshop may be a fake, Meijer believes. "Does the domain name match the website content, for example? Is the webshop known to the authorities and is a Chamber of Commerce registration number given anywhere? If there isn't a registration number, be careful. Grammatical and spelling errors should make you wary as well. And do the prices seem too good to be true? If so, they probably are too good to be true."

A blogpost by SIDN Labs linked to the academic article is available on sidnlabs.nl.

Downloads