💻 computer science

Uncovering Black-hat SEO based fake E-commerce scam groups from their redirectors and websites

This study analyzes a large dataset of 692,865 fake e-commerce sites collected over 2.5 years to identify and track 17 distinct threat actor groups that utilize black-hat SEO and redirectors to execute online scams.

Original authors: Makoto Shimamura, Shingo Matsugaya, Keisuke Sakai, Kosuke Takeshige, Masaki Hashimoto

Published 2026-03-31

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Makoto Shimamura, Shingo Matsugaya, Keisuke Sakai, Kosuke Takeshige, Masaki Hashimoto

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet as a giant, bustling marketplace. In this marketplace, there are honest shopkeepers selling real goods, but there are also fake street vendors setting up stalls to trick people into handing over their money or personal data. These are the "fake e-commerce sites."

For a long time, these scammers have been using a sneaky trick called "Black-Hat SEO." Think of this like a scammer paying a corrupt street sign-maker. The sign-maker puts up a sign on a legitimate, busy building (a compromised website) that says, "Best Deals Here!" but the sign actually points to the scammer's fake stall down the alley. When you search for "cheap shoes" on Google, you see that sign, click it, and end up at the scammer's trap instead of a real store.

This paper is like a detective report written by a team of cybersecurity investigators from Japan (including police and university researchers). They wanted to answer a big question: "Who are the masterminds behind these fake stalls, and how many different gangs are running them?"

Here is the story of their investigation, broken down simply:

1. The Massive Evidence Box

In the past, detectives only had a few scattered clues (a few malware samples). But this time, they got a giant evidence box from the Japan Cybercrime Control Center (JC3).

The Size: It contained over 690,000 fake websites collected over two and a half years.
The Goal: They didn't just want to shut down one website; they wanted to find the groups of criminals running them.

2. The Detective's Map (Link Analysis)

To find the gangs, the team used a special digital tool called Maltego. Imagine this tool as a giant connect-the-dots game.

The Dots: The dots were things like email addresses, website domains, and tracking servers (like Matomo or 51.la) that scammers use to see who visits their fake sites.
The Lines: If two fake websites used the same email address or the same tracking server, the tool drew a line between them.
The Result: If you see a huge cluster of dots all connected by lines, that's a criminal gang.

At first, the map was so messy it looked like a tangled ball of yarn with over 100,000 knots! The team wrote a computer program to untangle it. They found 1,118 potential groups, but most were tiny (like a one-person operation). They filtered them down to the 17 biggest gangs that were causing the most damage.

3. Tracking the Gangs Over Time (Time Series)

Once they identified the 17 big gangs, they watched them like a reality TV show to see how they behaved over time.

The Veterans: Some gangs (like "G1-1" and "G2-1") were like stubborn weeds; they were active from the very beginning of the study to the very end. They never stopped.
The Short-Termers: Other gangs popped up, did a few scams, and vanished in less than four months.
The New Kids: Some new gangs started appearing in 2024, suggesting the criminal underworld is constantly evolving.

4. The "Refund Scam" Case Study

The researchers tested their detective work with a real-world example. In early 2025, Japanese authorities warned about a new scam: "The Refund Trap."

How it works: A scammer tells a victim, "Oh no, your order is out of stock! Here is a code to get a refund." But the code actually tricks the victim into sending money to the scammer.
The Breakthrough: The team took the four websites listed in the official warning and ran them through their "connect-the-dots" map.
The Surprise: They found that these four different-looking scam sites actually belonged to the two largest criminal gangs they had identified earlier. This proved that these big gangs were sharing new, dangerous tricks with each other.

5. What Did They Learn? (The Takeaways)

It's Organized: Fake e-commerce isn't just random hackers; it's organized into distinct, large groups.
The Tools Matter: Big gangs tend to use specific tracking servers (Matomo), while smaller gangs prefer different tools (51.la). This helps police know which "fingerprint" to look for.
The Future: By knowing which gangs are active right now, law enforcement can focus their energy on the most dangerous players rather than chasing ghosts.

In a Nutshell

This paper is a roadmap for catching the scammers. Instead of just chasing individual fake websites (which is like trying to mop the floor while the faucet is still running), the researchers figured out who is holding the faucet. By identifying the specific criminal groups and how they operate, they hope to help police and security experts shut down the entire operation, not just one stall at a time.

1. Problem Statement

Fake e-commerce (EC) sites remain a significant threat to internet users, causing substantial financial damage and data theft. A primary technique used by threat actors to victimize users is Black-Hat SEO (Search Engine Optimization) poisoning, often referred to as the "Japanese Keyword Hack."

Mechanism: Threat actors compromise legitimate websites (referred to as redirectors) and install malware. This malware intercepts web server requests, specifically from search engine crawlers or users searching for Japanese keywords.
The Attack Flow: The malware serves a crafted sitemap to search engines, causing them to index "lure pages" that appear to be part of the legitimate site. When a user clicks a search result, the malware redirects the browser to a malicious fake EC site designed to steal money or personal information.
Research Gap: Previous studies analyzed the connection between specific malware families and fake EC sites but lacked completeness because they relied on manually collected malware samples. Consequently, the full scale of threat actor groups operating in Japan remained unknown.

2. Methodology

The authors utilized a large-scale dataset and a multi-stage link analysis approach to identify and characterize threat actor groups without relying on malware samples.

A. Dataset

Source: Japan Cybercrime Control Center (JC3).
Scope: 692,865 fake EC sites collected from redirectors between May 20, 2022, and December 31, 2024.
Entities Extracted:
- 105,286 Fake EC Domains.
- 13,456 Email Addresses.
- 36 Matomo Server URLs (used for visitor analytics).
- 4,958 IDs from 51.la (a popular Chinese access analyzer service).
Data Quality: The dataset was filtered via JC3's internal confirmation process, including manual analysis, ensuring high quality.

B. Link Analysis Strategy

The study employed Maltego (a link analysis tool) and custom Python scripts to visualize and cluster entities based on shared infrastructure. Three primary link types were defined:

Domain $\to$ Email Address: Sites sharing the same contact email are linked.
Domain $\to$ Matomo Server: Sites sharing the same analytics server are linked.
Domain $\to$ 51.la ID: Sites sharing the same analytics ID are linked.

Algorithmic Grouping:

Preliminary Clustering: A Python script (using a graph traversal algorithm) identified connected components from the dataset, initially detecting 1,118 groups.
Filtering: Groups with fewer than 200 domains or 2,000 sites were discarded to focus on significant actors. This left 8 major groups for initial review.
Subgroup Refinement: The algorithm was reapplied to split loosely connected groups (connected by only one weak link) into distinct subgroups.
Final Selection: A two-stage filter (200+ domains, then 2,000+ sites) resulted in 17 distinct threat actor groups for detailed analysis.

C. Time Series Analysis

The authors tracked the activity of these 17 groups on a monthly basis to observe:

Longevity of operations.
Succession patterns (e.g., if Group A stops and Group B starts, they may be related).
Emergence of new groups.

3. Key Contributions

Quantification of Threat Actors: Estimated the number of active threat actor groups conducting fake EC scams in Japan using Black-Hat SEO, moving beyond malware-centric analysis.
Infrastructure-Based Attribution: Successfully attributed fake EC sites to specific groups using shared infrastructure (Matomo, 51.la, Email) rather than malware signatures, overcoming the limitation of incomplete malware sample collection.
Temporal Tracking: Provided a time-series view of group activities, identifying which groups are persistent and which are transient.
Case Study Validation: Demonstrated the utility of the analysis by attributing a new "Refund Scam" strategy to specific identified groups.

4. Key Results

A. Group Identification

Total Groups Identified: 17 relatively large groups were active during the study period.
Dominant Groups:
- G1-1: The largest group, containing 11,822 domains and 2,345 email addresses. It was active throughout the entire dataset period.
- G2-1: The second largest, with 16,314 domains.
Infrastructure Preferences:
- Matomo: Larger groups (like G1 and G2) heavily utilized Matomo servers.
- 51.la: Smaller, dropped groups showed a strong preference for 51.la IDs (26% of dropped groups used 51.la vs. only 3 Matomo servers), suggesting smaller actors may share specific toolkits or manuals.

B. Time Series Analysis Findings

Persistence: Groups G1-1 and G2-1 remained active throughout the 2.5-year period, indicating stable, long-term operations.
Transience: Subgroups of G3 operated for short terms (less than 4 months).
Succession: Some groups (e.g., G1-2, G1-3) shrank or vanished in mid-2023, while others (e.g., G1-3) appeared to replace them, suggesting potential succession or rebranding.
New Actors: Groups G2-3, G9, and G11 became active in 2024, representing newer threats.

C. Case Study: Refund Scam

Context: In February 2025, the Japanese Consumer Affairs Agency (CAA) warned of a "refund scam" where victims are tricked into sending money via payment apps under the guise of a refund.
Attribution: The authors analyzed four specific domains cited in the CAA warning.
- Two domains were exact matches in the dataset; two were linked via shared subdomains.
- Result: The scam was attributed to Group G1-1 and Group G2-1 (the two largest identified groups).
- Implication: This suggests that sophisticated, large-scale groups are adopting new scam strategies (refund scams) on top of their existing fake EC operations.

5. Significance and Implications

Law Enforcement Utility: The identified groups provide actionable intelligence for law enforcement to track persistent actors rather than just individual domains.
Countermeasure Indicators:
- Matomo Servers: The specific Matomo domains used by these groups (e.g., la51[.]xyz, omtage[.]top) can serve as indicators of compromise (IoC) for blocking fake EC sites.
- 51.la Limitations: Due to the high volume of 51.la IDs (e.g., G1-1 used 2,291 unique IDs), blocking by ID is less effective than blocking by Matomo server domains.
Ethical Handling: The study carefully masked PII and raw URLs (except for public CAA warnings) to prevent accidental exposure of legitimate personnel whose identities might have been stolen by threat actors.
Future Directions: The authors suggest that grouping enables deeper analysis of unique group characteristics and that future work should focus on automating the detection of these infrastructure patterns to protect users in real-time.

Conclusion

This paper successfully shifts the focus from malware analysis to infrastructure-based clustering to uncover the scale of Black-Hat SEO fake EC scams in Japan. By analyzing a massive dataset of 692,000+ sites, the researchers identified 17 major threat actor groups, tracked their evolution over time, and linked them to emerging scam tactics, providing a robust framework for future cybercrime attribution and prevention.