LogoMotive: Detecting Logos on Websites to Identify Online Scams - A TLD Case Study

Thijs van den Hout; Thymen Wabeke; Giovane C.M. Moura; Cristian Hesselman

doi:10.1007/978-3-030-98785-5_1

LogoMotive: Detecting Logos on Websites to Identify Online Scams - A TLD Case Study

Thijs van den Hout^*, Thymen Wabeke, Giovane C.M. Moura, Cristian Hesselman

^*Corresponding author for this work

Cyber Security

Research output: Chapter in Book/Conference proceedings/Edited volume › Conference contribution › Scientific › peer-review

2 Citations (Scopus)

12 Downloads (Pure)

Abstract

Logos give a website a familiar feel and promote trust. Scammers take advantage of that by using well-known organizations’ logos on malicious websites. Unsuspecting Internet users see these logos and think they are looking at a government website or legitimate webshop, when it is a phishing site, a counterfeit webshop, or a site set up to spread misinformation. We present the largest logo detection study on websites to date. We analyze 6.2M domain names from the Netherlands ’ country-code top-level domain.nl, in two case studies to detect logo misuse for two organizations: the Dutch national government and Thuiswinkel Waarborg, an organization that issues certified webshop trust marks. We show how we can detect phishing, spear phishing, dormant phishing attacks, and brand misuse. To that end, we developed LogoMotive, an application that crawls domain names, generates screenshots, and detects logos using supervised machine learning. LogoMotive is operational in the.nl registry, and it is generalizable to detect any other logo in any DNS zone to help identify abuse.

Original language	English
Title of host publication	Passive and Active Measurement - 23rd International Conference, PAM 2022, Proceedings
Editors	Oliver Hohlfeld, Giovane Moura, Cristel Pelsser
Publisher	Springer
Pages	3-29
Number of pages	27
ISBN (Print)	9783030987848
DOIs	https://doi.org/10.1007/978-3-030-98785-5_1
Publication status	Published - 2022
Event	23rd International Conference on Passive and Active Measurement, PAM 2022 - Virtual, Online Duration: 28 Mar 2022 → 30 Mar 2022

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	13210 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	23rd International Conference on Passive and Active Measurement, PAM 2022
City	Virtual, Online
Period	28/03/22 → 30/03/22

Bibliographical note

Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care
Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public.

Access to Document

10.1007/978-3-030-98785-5_1

978-3-030-98785-5_1Final published version, 2 MB

Cite this

van den Hout, T., Wabeke, T., Moura, G. C. M., & Hesselman, C. (2022). LogoMotive: Detecting Logos on Websites to Identify Online Scams - A TLD Case Study. In O. Hohlfeld, G. Moura, & C. Pelsser (Eds.), Passive and Active Measurement - 23rd International Conference, PAM 2022, Proceedings (pp. 3-29). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 13210 LNCS). Springer. https://doi.org/10.1007/978-3-030-98785-5_1

van den Hout, Thijs ; Wabeke, Thymen ; Moura, Giovane C.M. et al. / LogoMotive : Detecting Logos on Websites to Identify Online Scams - A TLD Case Study. Passive and Active Measurement - 23rd International Conference, PAM 2022, Proceedings. editor / Oliver Hohlfeld ; Giovane Moura ; Cristel Pelsser. Springer, 2022. pp. 3-29 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{903222c7ff804857b91015e65de09ab1,

title = "LogoMotive: Detecting Logos on Websites to Identify Online Scams - A TLD Case Study",

abstract = "Logos give a website a familiar feel and promote trust. Scammers take advantage of that by using well-known organizations{\textquoteright} logos on malicious websites. Unsuspecting Internet users see these logos and think they are looking at a government website or legitimate webshop, when it is a phishing site, a counterfeit webshop, or a site set up to spread misinformation. We present the largest logo detection study on websites to date. We analyze 6.2M domain names from the Netherlands {\textquoteright} country-code top-level domain.nl, in two case studies to detect logo misuse for two organizations: the Dutch national government and Thuiswinkel Waarborg, an organization that issues certified webshop trust marks. We show how we can detect phishing, spear phishing, dormant phishing attacks, and brand misuse. To that end, we developed LogoMotive, an application that crawls domain names, generates screenshots, and detects logos using supervised machine learning. LogoMotive is operational in the.nl registry, and it is generalizable to detect any other logo in any DNS zone to help identify abuse.",

author = "{van den Hout}, Thijs and Thymen Wabeke and Moura, {Giovane C.M.} and Cristian Hesselman",

note = "Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public.; 23rd International Conference on Passive and Active Measurement, PAM 2022 ; Conference date: 28-03-2022 Through 30-03-2022",

year = "2022",

doi = "10.1007/978-3-030-98785-5_1",

language = "English",

isbn = "9783030987848",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer",

pages = "3--29",

editor = "Oliver Hohlfeld and Giovane Moura and Cristel Pelsser",

booktitle = "Passive and Active Measurement - 23rd International Conference, PAM 2022, Proceedings",

}

van den Hout, T, Wabeke, T, Moura, GCM & Hesselman, C 2022, LogoMotive: Detecting Logos on Websites to Identify Online Scams - A TLD Case Study. in O Hohlfeld, G Moura & C Pelsser (eds), Passive and Active Measurement - 23rd International Conference, PAM 2022, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 13210 LNCS, Springer, pp. 3-29, 23rd International Conference on Passive and Active Measurement, PAM 2022, Virtual, Online, 28/03/22. https://doi.org/10.1007/978-3-030-98785-5_1

LogoMotive: Detecting Logos on Websites to Identify Online Scams - A TLD Case Study. / van den Hout, Thijs; Wabeke, Thymen; Moura, Giovane C.M. et al.
Passive and Active Measurement - 23rd International Conference, PAM 2022, Proceedings. ed. / Oliver Hohlfeld; Giovane Moura; Cristel Pelsser. Springer, 2022. p. 3-29 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 13210 LNCS).

Research output: Chapter in Book/Conference proceedings/Edited volume › Conference contribution › Scientific › peer-review

TY - GEN

T1 - LogoMotive

T2 - 23rd International Conference on Passive and Active Measurement, PAM 2022

AU - van den Hout, Thijs

AU - Wabeke, Thymen

AU - Moura, Giovane C.M.

AU - Hesselman, Cristian

N1 - Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public.

PY - 2022

Y1 - 2022

N2 - Logos give a website a familiar feel and promote trust. Scammers take advantage of that by using well-known organizations’ logos on malicious websites. Unsuspecting Internet users see these logos and think they are looking at a government website or legitimate webshop, when it is a phishing site, a counterfeit webshop, or a site set up to spread misinformation. We present the largest logo detection study on websites to date. We analyze 6.2M domain names from the Netherlands ’ country-code top-level domain.nl, in two case studies to detect logo misuse for two organizations: the Dutch national government and Thuiswinkel Waarborg, an organization that issues certified webshop trust marks. We show how we can detect phishing, spear phishing, dormant phishing attacks, and brand misuse. To that end, we developed LogoMotive, an application that crawls domain names, generates screenshots, and detects logos using supervised machine learning. LogoMotive is operational in the.nl registry, and it is generalizable to detect any other logo in any DNS zone to help identify abuse.

AB - Logos give a website a familiar feel and promote trust. Scammers take advantage of that by using well-known organizations’ logos on malicious websites. Unsuspecting Internet users see these logos and think they are looking at a government website or legitimate webshop, when it is a phishing site, a counterfeit webshop, or a site set up to spread misinformation. We present the largest logo detection study on websites to date. We analyze 6.2M domain names from the Netherlands ’ country-code top-level domain.nl, in two case studies to detect logo misuse for two organizations: the Dutch national government and Thuiswinkel Waarborg, an organization that issues certified webshop trust marks. We show how we can detect phishing, spear phishing, dormant phishing attacks, and brand misuse. To that end, we developed LogoMotive, an application that crawls domain names, generates screenshots, and detects logos using supervised machine learning. LogoMotive is operational in the.nl registry, and it is generalizable to detect any other logo in any DNS zone to help identify abuse.

UR - http://www.scopus.com/inward/record.url?scp=85127918622&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-98785-5_1

DO - 10.1007/978-3-030-98785-5_1

M3 - Conference contribution

AN - SCOPUS:85127918622

SN - 9783030987848

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 3

EP - 29

BT - Passive and Active Measurement - 23rd International Conference, PAM 2022, Proceedings

A2 - Hohlfeld, Oliver

A2 - Moura, Giovane

A2 - Pelsser, Cristel

PB - Springer

Y2 - 28 March 2022 through 30 March 2022

ER -

van den Hout T, Wabeke T, Moura GCM, Hesselman C. LogoMotive: Detecting Logos on Websites to Identify Online Scams - A TLD Case Study. In Hohlfeld O, Moura G, Pelsser C, editors, Passive and Active Measurement - 23rd International Conference, PAM 2022, Proceedings. Springer. 2022. p. 3-29. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-030-98785-5_1