Inside the SCAM Jungle:

A Closer Look at 419 Scam Email Operations

Jelena Isacenkova

∗

, Olivier Thonnard

†

, Andrei Costin

∗

, Davide Balzarotti

Symantec Research Labs

Abstract—Nigerian scam is a popular form of fraud in

as important identifiers to group messages together and

depict the way scammers operate their campaigns. In fact,

since the victim has to be able to contact the criminal,

both email addresses and phone numbers need to be

authentic and they are often unchanged and re-used for

a long period of time. We also present in details several

examples of Nigerian scam campaigns, some of which last

for several years - representing them in a graphical way

and discussing their characteristics.

I. INTRODUCTION

cated [4] and can often be evaded by criminals. As a

result, reports of such crime still appear in the social

media and online communities, e.g. 419scam.org [1],

exist to mitigate the risk and help users to identify scam

messages.

Nowadays, 419 scam is often perceived as a partic-

ular type of spam. However, while most of the spam

is now sent mainly by botnets and by compromised

machines in bulk quantities, Nigerian scam activities

are still largely performed in a manual way. Moreover,

Even though today 419 scam messages are eclipsed by

the large amount of spam sent by botnets, they are still

a problem that causes substantial financial losses for a

number of victims all around the world.

A distinctive characteristic of email fraud is the

communication channel set up to reach the victim: from

this point of view, scammers tend to use emails and/or

phone numbers as their main contacts [5], while other

forms of spam are more likely to forward their victims

to specific URLs. For instance, a previous study of spam

a number of malicious activities. The authors show that

the phone numbers used by scammers are often active

for a long period of time and are reused over and over

in different emails, making them an attractive feature

to link together scam messages and identify possible

campaigns. In this work, we test this hypotesis by using

phone numbers and othe email features to automatically

detect and study scam campaigns in a public dataset.

In particular, we apply a multi-dimensional clustering

technique to group together similar messages to identify

together. Our experiments also show that it is possible

to identify macro-clusters, i.e. large groups of scam

campaigns probably run by the same criminal groups.

The rest of the paper is organized as follows. We start

by describing the scam dataset (Section III), to which

we apply our cluster analysis technique to extract scam

campaigns, and compare the usage of email addresses

and phone numbers (Section IV). In Section V we

focus on a number of individual campaigns to present

their characteristics. Finally, we draw our conclusions

the tricks of Nigerian fee fraud and the philosophy of

tricksters behind. Stajano and Wilson [10] studied a

number of scam techniques and showed the importance

of security engineering operations. A brief summary of

Nigerian scam schemes was presented by Buchanan and

Grant [4] indicating that Internet growth has facilitated

the spread of cyber fraud. They also emphasize the

model for scam 419 email text mining demonstrating

high precision in detection. A work by Pathak et al. [9]

analyses email spam campaigns sent by botnets, de-

scribing their patterns and characteristics. The authors

also show that 15% of the spam messages contained

a phone number. A recent patent has been published

by Coomer [2] on a technique that detects scam and

spam emails through phone number analysis. This is

the first mentioning of phone numbers being used for

identifying scam. Costin et al. [5] studied the role of

In this section we describe the dataset we used

for analyzing 419 scam campaigns and provide some

insights into the scam messages. There are various

sources of scam often reported by users and aggregated

afterwards by dedicated communities, forums, and other

online activity groups. The data chosen for our analysis

come from 419scam.org - a 419 scam aggregator -

as it provides a large set of preprocessed data: email

bodies, headers, and some already extracted emails at-

thing to notice is that the number of messages is three

times bigger than the number of phone numbers. We

did not notice any significant bursts of scam messages

(verified on a monthly basis) during the three year span,

suggesting that the email messages were constantly

distributed over time. It is also important to note that the

dataset is mostly limited to the European and African

regions (with also a few Asian samples), which is

due to the way the website owners are collecting and

classifying the data.

unveiling even varying relationships among series of

connected or disparate events.

as a security tool designed for intelligence extraction

helping to determine the patterns and behaviors of the

intruders, and highlighting “how” they operate rather

than “what” they do. The framework [11] has already

demonstrated its utility in various analyses threats, e.g.,

rogue AV campaigns [6], spam botnets [13] and targeted

From), email subject, date, Reply-To address, scammer

phone number and email address found in the message

body. Then, relationships among all email samples are

built with respect to the selected features using appro-

priate comparison methods integrated in the framework.

At the third step, the aggregation model fuses all

features based on a set of weights defined to reflect

feature importances and interactions during data fusion.

We define parameters weighting thanks to the insights

gained from previous study of scam phone numbers [5].

number of common traits. As explained in [11], the

user can specify a threshold at which a link between

clusters is created and that controls the relevance of the

data within the same cluster. In our analysis, we choose

a threshold of 0.30 by which any group of emails linked

by a coalition of two similar features that includes at

least the phone number, or by at least three similar

features (no matter which combination), will exceed the

threshold and thus create a cluster.

B. Clustering results

We identified 1,040 clusters with

These, though, give no indication on the actual number

of individuals that are behind each campaign. Based on

the topologies of those campaigns, we anticipate there

could be more than a single person in most cases. We

look at this aspect in more details in section V.

Table III: Global statistics for the top 250 clusters

Nr emails 38 28 376

Nr from 13.9 9 181

Nr reply 6.2 5 56

across the top-250 largest scam campaigns. In over

half of these campaigns, scammers are using only two

distinct phone numbers, but they still make use of

more than 5 different mailboxes to get the answers

from their victims. Most scam campaigns are rather

long-lived (lasting on average about a year). We note

that cluster sizes are small on average indicating that

there are many small, isolated campaigns and only a

few dozens of messages belong to the same campaign.

This might be also an artefact of the data collection

get blocked on earlier stages of email filtering.

To confirm our intuition about the importance of

certain features (phone numbers, and to a lesser extent,

email addresses) and their effective role in identifying

campaigns, we look at all similarity links within clus-

ters. We observe that the features mainly responsible

for linking scam messages in the clusters involve phone

numbers (in 88% cases), followed by the reply email

address (for 66% of the links). Not surprisingly, the from

address (which can be easily spoofed) changes much

Figure 3: Duration of phone numbers and emails used

only one day, so there is a slight concentration on the

left side of the plot. However, the phone numbers are

more often reused over time than email addresses. This

could be explained by an easy access to new mailboxes

offered by many free email providers. As for the phone,

they probably still require some financial investment

compared with emails. We checked the domain names

of email addresses used in our scam dataset and found

that top 100 belong to webmail providers from all over

the world. This finding suggests that email messages

gorization is too broad, we decided to evaluate ourselves

the categories in our dataset by measureing the word

frequency in the body of the scam messages. To extract

some more generalized knowledge of the clustered

data, we create a list of the most repetitive keywords

(after removing all the stop words) and group them

into meaningful categories. As a result, we identified

three big categories within clusters: money transfer and

bank related fraud (54%), lottery scam (22%), and fake

delivery services (11%). The rest is uncategorized and

B. Macro clusters: connecting sub-campaigns

in Africa and located in one or two countries. The first

three are more Europe-oriented with some connections

to Nigeria and Benin. These groups are competing in

“fake lottery” scam, with the second group leading

the pack and covering most of the countries. In com-

parison to previous similar study of scam campaign

geographical distribution [5], we note that we encounter

less UK and Nigerian numbers in campaigns, but at

the same time confirm that scam campaigns can be

multi-continental. The largest macro-campaign (#2) we

66FRWW#DROFRP

LQIR#UROH[FRP

cluster campaigns

LQIR#JXLQQHVVFRXN

Figure 6: An example of macro-cluster. The nodes laid in clock-wise fashion reflect the timeline of the campaigns.

identified is potentially orchestrated by several groups

for all data, clusters and macro-clusters respectively. We

note also that the unclustered data is concentrated in

African countries and that emails with a reference to

European countries mostly get clustered with a quite big

share in macro-clusters. This suggests that some scam-

mers from African countries try to run more compli-

cated Europe-based campaigns (mostly “fake lottery”).

Those would possibly provide better revenues or provide

more attractive (rich) victims. Additionally, as we saw

panied by African emails. Still, the majority of the other

unclustered emails are from African continent, probably

some campaigns run by a single person, possibly trying

to start a new or improve an existing scam-business,

and are thus more difficult to correlate and group into

bigger scam clusters.

ONCLUSIONS

In this study, we identified around a thousand 419

scam campaigns with the help of a multi-dimensional

clustering technique for grouping similar emails. We

We also discussed the crucial role played by email

addresses and phone numbers in scam business, in

contrast with other cyber crime schemes where email

addresses may be often spoofed and phone numbers

rarely used. We also discovered that scammers re-use

the same phone numbers and email addresses over long

periods of time – sometimes up to 3 or 4 years. At the

same time, scammers seem to send very low volumes

of emails compared to spammers.

Finally, we uncovered the existence of macro-

schemes – other than scam campaigns as well.

CKNOWLEDGMENTS

This research was partly supported by the European Com-

mission’s Seventh Framework Programme (FP7 2007-2013)

under grant agreement nr. 257495 (VIS-SENSE). The opinions

expressed in this paper are those of the authors and do not

necessarily reflect the views of the European Commission.

REFERENCES