  Technical Support Scams (TSS), which combine online abuse with social
engineering over the phone channel, have persisted despite several law
enforcement actions. The tactics used by these scammers have evolved over time
and they have targeted an ever increasing number of technology brands. Although
recent research has provided insights into TSS, these scams have now evolved to
exploit ubiquitously used online services such as search and sponsored
advertisements served in response to search queries. We use a data-driven
approach to understand search-and-ad abuse by TSS to gain visibility into the
online infrastructure that facilitates it. By carefully formulating tech
support queries with multiple search engines, we collect data about both the
support infrastructure and the websites to which TSS victims are directed when
they search online for tech support resources. We augment this with a DNS-based
amplification technique to further enhance visibility into this abuse
infrastructure. By analyzing the collected data, we demonstrate that tech
support scammers are (1) successful in getting major as well as custom search
engines to return links to websites controlled by them, and (2) they are able
to get ad networks to serve malicious advertisements that lead to scam pages.
Our study period of 8 months uncovered over 9,000 TSS domains, of both passive
and aggressive types, with minimal overlap between sets that are reached via
organic search results and sponsored ads. Also, we found over 2,400 support
domains which aid the TSS domains in manipulating organic search results.
Moreover, we found little overlap with domains that are reached via abuse of
domain parking and URL-shortening services which was investigated previously.
Thus, investigation of search-and-ad abuse provides new insights into TSS
tactics and helps detect previously unknown abuse infrastructure that
facilitates these scams.
