SBN

Arkose Email Intelligence For Bot Mitigation is Here

Arkose Email Intelligence For Bot Mitigation is Here

To some degree, the recent period of massive economic change was felt by nearly every enterprise-sized company. The stock market rally took a pause, and businesses re-learned the meaning of prioritization and growth. One thing that didn’t change, though, was the collective intent of adversaries to profit from online attacks. The fact that a recession seemed imminent, and businesses were cutting costs, made the adversaries even more ambitious.

At Arkose Labs, we observed both innovative and status-quo attacks, ranging from device and browser signature manipulation and IP system abuse to coordinated attacks in partnership with fraud farms. We also noticed that attackers consistently abuse our customers’ sign-up flows using fake email addresses, an attack vector that has traditionally been blind to bot prevention systems.

Email Addresses: A Great Tool For Abuse

Approximately 4.3 billion email users existed in 2022, and online services have always allowed new users to sign up for their services using an email address. This opens a massive window of opportunity for fraudsters.

A new email address is free and easy to create. Fraudsters leverage this flexibility to create new email addresses in troves and use those to create fake accounts on online services. What’s interesting is that a significant number of those fraudsters don’t manipulate other attack vectors such as browser and device fingerprints, proxy usage, network-level manipulations, etc., making it immensely difficult for traditional bot detection systems to detect this abuse. Additionally, fraudsters stay under the radar by performing low and slow attacks so that rate-limiting systems are not triggered.

This is why Arkose Labs built Arkose Email Intelligence™ within both our Arkose Detect and Arkose Protect stack. The service analyzes more than 50 signals related solely to the email address in real-time, which are then used to apply pressure dynamically on the traffic to prevent bots from attacking our customers.

Below is a graph showing the traffic to the Arkose Email Intelligence from the service’s early adopters. Generally speaking, this graph doesn’t represent an attack except for a couple of random spikes.

 

However, upon further investigation, we noticed a continuous presence of traffic from risky emails staying under the radar (shown in the graph below). There are occasional spikes, but they are relatively low in the grand scheme of things to trigger an alarm.

What’s more interesting is that a significant portion of the traffic from risky emails continues going undetected (shown in the graph below) by the traditional bot detection systems we had in place since these fraudsters didn’t manipulate anything else apart from email addresses to commit the fraud. 

A Methodical Approach To Abuse

There are several ways to use a risky email address to create fake online accounts, and fraudsters use a methodical approach to make such abuse successful. Some are easy to detect, but most are complex.

When bad actors intend to abuse an online platform for financial gain (such as abusing an ongoing promotion), they create new email addresses using one of the free services. They then leverage those new emails for multiple sign-ups and promotional campaign usage. This type of abuse, known as Email Enumeration and Email Tumbling abuse, is often contextual and difficult to detect since there are legitimate usages of tumbled emails.

This detection and action thereafter become significantly more difficult for businesses when minimizing friction for good users is the primary goal.

We noticed a stream of traffic with risky emails that were abusing the tumbling feature as well as enumerating existing email addresses (shown below). We have built several guardrails to ensure that the false positives remain at a minimum.

Another way fraudsters attack is by creating emails on disposable or recently created domains. Disposable domains are created for specific purposes and one such purpose is to commit fraud. There are several free and paid websites that offer an option to create new emails on disposable domains. Once the motive is fulfilled, fraudsters abandon that account and create a new one.

We noticed continuous sign-up traffic from disposable and brand-new domains detected by our email intelligence service that would generally be considered risky.

Programmatic, Bot-Driven Attacks

Not all attacks involving email address abuse are low and slow and manually-driven. There are attacks that can be launched programmatically. This involves creating new email addresses that look gibberish or fake to the human eye, but are indistinguishable from good email addresses to a machine. Fraudsters typically leverage bots for launching these attacks. Email handles are created using predefined patterns that are regularly rotated to avoid detection.

This is the most difficult type of attack to detect and hence, often is not a part of similar email intelligence services available in the market. The alternative, an email validation service, is too latency and error-prone to be used in the latency-sensitive flows. Our proprietary algorithm detects such attacks, and we continue to see fraudsters using this mechanism for fake sign-ups (as shown in the graph below).

 

These are just some of the ways fraudsters use to create fake accounts using an email address. Arkose Email Intelligence looks for several such possible attack types to determine risk. Additionally, a dedicated R&D team continuously looks out for additional threat vectors that can be incorporated to make the service more effective.

Arkose Email Intelligence: An Ingenious And Cost-Effective Way To Mitigate Bot Attacks

Traditional email Intelligence offerings are too expensive for businesses to leverage at a bot scale, and most businesses leverage these services only on already flagged traffic or on specific, high-value transactions.

From the beginning, our goal was to make Arkose Email Intelligence economically viable for our customers so that it can be utilized for ALL incoming traffic that contains an email address. In fact, we are the first in the industry to leverage email intelligence for bot mitigation. 

Advantages of Arkose Email Intelligence 

  • Seamlessly integrates within Arkose Detect and Arkose Protect
  • Uses a combination of heuristics and self-learning models to detect abuse
  • Provides crucial inputs to the Arkose challenge technology so that the right amount of pressure can be applied to mitigate bot attacks. This means it can be used for automated bot attacks as well as “low-and-slow” human-driven attacks.

The early results are extremely positive and we have seen our overall fraud catch rate go up between 20% and 70% depending on the customer’s traffic. The positive results have prompted several of our customers to either onboard Arkose Email Intelligence, or test with an intent to onboard gradually.

Rich Threat Intelligence Via API Response

To continue our commitment to transparency and to enable our customers to use the intelligence generated by the Arkose Labs platform, we will share rich, actionable insights via the Verify API response along with a suggested action that customers can directly leverage to create downstream workflows.

Summary of Arkose Email Intelligence

The massive use of email addresses as a tool for abuse by automated bots and human-driven attacks is a major issue for businesses. Arkose Labs built the Arkose Email Intelligence service to address this problem by analyzing more than 50 signals related solely to the email address in real time, making it a cost-effective solution to mitigate bot attacks. 

Arkose Email Intelligence can detect various types of email abuse including email enumeration and email tumbling, disposable domains, and programmatic attacks. This is achieved through a proprietary algorithm and continuous research and development by the dedicated R&D team. With Arkose Email Intelligence, businesses can effectively prevent fake account creation and protect their online platforms from fraudulent activities.

To find out how we can help your business stop bots in their tracks, send us a message! We are here to help. 

*** This is a Security Bloggers Network syndicated blog from Arkose Labs authored by Ayan Halder. Read the original post at: https://www.arkoselabs.com/blog/arkose-email-intelligence-for-bot-mitigation-is-here/