## 2 Materials and Methods
### Primary Dataset Preparation  
In this study, we used publicly available sources to create our own dataset [36] that contains 1140 records of 579 fraudulent and 561 legitimate online shops. This dataset consists of 18 features obtained by analyzing the URL of the online shop, checking the SSL certificate, analyzing the content of the online shop, and receiving features from third-party publicly available services. This custom dataset was created for the following reasons:  
1. The majority of the publicly available datasets contain all kinds of phishing websites, characterized by different features, some of them completely not relevant to online shops. 2. The existing datasets dedicated to online shops do not contain all the proposed features, which require one to extract additional data from the website content and third-party services. In order to create the initial URL list of fraudulent online shops (see Figure 1), a few publicly available sources were used: Watchlist Internet [40], Artists Against 419 [41], and Global e-Commerce Websites List [42]. This list was complemented with URLs of legitimate online shops taken from Trusted shops [43], Ecommerce Trustmark [44], EHI Geprufter Online-Shop [45], Retail Excellence [46] and Similarweb [47], and manually adding URLs of well-known shops. As a result, we obtained a file with records containing the URL of the web shop and its label (malware or safe). These URLs were used to create the primary dataset using a Python script and manual procedures to extract the 18 features. The Python script was used to analyze the URL of the online shop, the SSL certificate, and the source code of its website. This script also called APIs of third-party services, including WHOIS, TrancoList, TrustPilot, and SiteJabber. The pages of online shops were opened manually to check the availability of the favicon and the relationship with the online shop. In this study, seven URL-based features were used (Table 1). The URL-based features were obtained from the protocol and host domain, which consists of the second level  
Figure 1: The methodology for evaluating possible combinations of features for the detection of fraudulent online shops. domain and the top-level domain. URL components such as the path and the query were eliminated and not included as features. The URLs of the internal pages of an online shop, such as the product description and shopping cart, usually consist of many different characters, but this does not indicate whether the shop is fraudulent or legitimate. The _F1_ and _F2_ features are related to the URL length. _F1_ is the number of characters in the host domain name and _F2_ is the number of characters in the top domain name. Legitimate online shops seek to obtain a short and memorable hostname. _F3_ indicates whether the World Wide Web prefix is used in the URLs of the online shop. Legitimate online shops quite often use the URL without the prefix \"www\", and if the user enters the link with the prefix \"www\", the link is automatically shortened. The _F4-F7_ features indicate how many different characters the URL contains, such as numbers, letters, dots, and hyphens. Characters, except numbers, letters, dots, and hyphens, are not allowed in domain names. _F8-F13_ are content-based features. Four features are related to the payment methods on the website. F8 indicates whether the website offers payment using credit cards. _F9_ indicates whether online shop buyers can use a payment method that allows them to get money back, including PayPal, Alipay, Apple Pay, Google Pay, Samsung Pay, and Amazon Pay. _F10_ indicates whether the website offers payment methods that allow the buyer to pay for the goods when they are received. _F11_ indicates whether the website allows payments using crypto currency. Legitimate online shops usually provide payment methods that encourage buyers to buy goods knowing that they can get their money back in the case of damaged, lost or unsuitable goods.