This is fresh off the press:*
How to hijack a journal. J. Bohannon. Science 350 no. 6263, p. 903. 20 November 2015.
I just saw it and I find it intensely worrying. In short, it appears that scam attacks on legitimate journals are now going beyond fake websites of the form 'sciencernag.com', to actually taking control of the internet domain name of journals.
The symptoms of such an attack might look something like this: you want to submit a publication to this hot new open access Journal of Scientific Results your collaborator just told you about. You look for the journal name on Google and you click on the top result. It looks essentially fine: correct website feel, new papers on the front page, etc. Out of curiosity, you might wander over to Thomson Reuters to see what they say about JSR, and maybe even notice that the website listed is the one you just went to. So you go over and you submit your paper, and when they ask you for article processing charges you might go ahead and pay them.
However, the journal website is in fact in control of a group of scammers, through a combination of means apparently to do mostly with the jittery ways in which the administration of web domains takes place. (The true JSR might be at a new website, trying to draw traffic there but powerless to stop the new owners of the domain.)
This sort of attack seems pretty much impossible to avoid as a reader or author caught unawares. (This is unlike, say, falling in the hands of a predatory journal, where much can be done by consulting Jeffrey Beall's list of potential predatory journals and publishers.) Bohannon's piece suggests that to verify the authenticity of a journal website against such an attack, a cautious visitor might try the following.
Dadkhah suggested two ways to spot a hijacking. First, check the domain registration data online by performing a WHOIS query. (It's not an acronym, but rather a computer protocol to look up “who is” behind a particular domain.) If the registration date is recent but the journal has been around for years, that's the first clue. Also suspicious is if the domain's country of registration is different from the journal's publisher, or if the publisher's name and contact information are kept anonymous by private domain registrars.
This seems incredibly onerous to me. It might be justified if one is about to fork over manuscripts or money to a smaller journal, but it's definitely much more sleuthing than I'd find reasonable for just casual browsing. However, it's not clear to me that there are any surefire alternatives to this (and even then, WHOIS queries can only run up suspicions, but they might miss e.g. what happened to Acta Physico-Chimica Sinica). Bohannon has provided a list of hijacked journal websites as supplemental data to the piece, but this is not necessarily complete and it would need someone curating it with a dedication to match Beall's to keep it updated.
I'm asking this mostly to raise awareness, but I do have a genuine question. Are there methods and institutions within academia that could be used to prevent or hinder these sorts of attacks? This sort of thing is probably not new in business, where it is very often sink or swim for companies (so there is more awareness that you need to protect your brand against things like this) but there is also more scope for companies to reinvent themselves (whereas it is very hard for an academic journal to change its name or website and expect their entire community to be aware of the change, unless it makes a big splash like the recent shift in Lingua did).
So academia has its own particular weaknesses to this sort of thing, but we also have a bigger set of structures and institutions that can work to prevent things like attacks on reputation from working. (In fact, it is the fact that one of these mechanisms - the Thomson Reuters listings - has failed that makes this such a serious thing, even if the actual scope is probably still relatively small.) What broader tools could we as a community implement to try and hinder this sort of stuff, and how would those mechanisms look?
* So hot off the press, in fact, that it was published in the future as of this posting.