Empirically Characterizing Domain Abuse and the Revenue Impact of Blacklisting

Using ground truth sales data for over 40K unlicensed prescription pharmaceuticals sites, we present an economic analysis of two aspects of domain abuse in the online counterfeit drug market. First, we characterize the nature of domains abused by affiliate spammers to monetize what is evidently an overwhelming demand for these drugs. We found that the most successful affiliates are agile in adapting to adversarial circumstances, and channel the full spectrum of domain abuse to advertise to customers. Second, we use contemporaneous blacklisting data to provide an economic analysis of the revenue impact of domain blacklisting, a technique whereby lists of “known bad” registered domains are distributed and used to filter email spam. We found that blacklisting rapidly and effectively limited per-domain sales. Nevertheless, blacklisted domains continued to monetize, likely as a result of high demand, non-universal use of blacklisting, and delay in deployment. Finally, our results suggest that increasing the number of domains discovered and using blacklists to block access to spam domains could undermine profitability more than further improving the speed with which domains are added to blacklists.