# Double-Constrained Consensus Clustering with Application to Online Anti-Counterfeiting
## 5 Experimenting with Counterfeit Web Shops
### Experiment Design and Preparation
#### 5.2.5 Automatic Acquisition of Constraints  
We now turn to the acquisition of constraints. While the clustering features introduced above are only indicative of membership (i.e., two domains sharing the same feature may or may not belong to an affiliate program), in the web anti-counterfeiting field, it is sometimes possible to state that two different web domains are, in fact, linked to the same entity by leveraging certain registration and network information, as well as specific content on their websites. The latter type of information can be regarded as high-confidence but infrequent features, as opposed to the frequent yet lower-confidence features used as proper clustering features in Section 5.2.3. In particular, a must-link constraint between two domain names can be created with some certainty when one of the following properties is satisfied:  
* _Redirection_: Some fake websites redirect the visitor from the initial web domain to one or more additional sites, ultimately resolving the final web page [50]. This is achieved either through URL redirection, whereby a fake web page is made available in parallel under more than one URL address, or through search redirection, in which fake websites hack high-ranking websites to redirect to their store based on the user's search query [52]. If two fake websites share the same final domain after redirection, they almost certainly belong to one affiliate marketing network.
* _Same IP address_: Multiple websites can be hosted on one web server. If two fake websites have the same resolved IP address for their domain names, then it is very likely that they were created by the same entity [53].
* _Same WHOIS Registrant data_: Although domain name registrant information (name, email, address), as provided by databases like WHOIS, is largely incomplete due to several issues (including privacy regulations), shared registrant data is a clear indication that two fake websites are linked because it means that they have been registered by the same legal person (juridical or natural).
* _Same website contact information_: Fake websites try to resemble genuine websites to increase visitor trust. This includes providing reassuring contact information such as an email address or telephone number and also a physical address and links to the web pages of physical stores. If two fake websites share those data, they probably belong to one affiliate marketing program.
* _Same Google Analytics ID_: Third-party analytics services are used by many e-commerce websites to better understand their customers. If two fake websites contain thesame Analytics ID within their source code, it means that they are reporting to the same Analytics account and presumably are part of one affiliation program. Finding matching Google Analytics IDs has been used to group illicit websites into connected campaigns [54].  
We automatically acquired the features necessary to assess the above-mentioned properties (when available) for any of the 121 websites in CAP, and then, through pairwise comparison, we generated 53 must-links, 32 of which were non-redundant. This is a small fraction of the total number of must-links, but it may be enough to drive the process of constrained consensus clustering and significantly improve performance improvement, as shown in the next section.