Is Spamdexing on the rise?

winhelp2002 — Sat, 01 Dec 2007 07:45:00 GMT

There has been a lot of media coverage lately on this subject ... while it's (finally) nice to see this problem is getting the attention it deserves ... this is nothing new. Spamdexing has been going on for years ...

"Spamdexing or search engine spamming is the practice of deliberately and dishonestly modifying HTML pages to increase the chance of them being placed close to the beginning of search engine results, or to influence the category to which the page is assigned in a dishonest manner. Many designers of web pages try to get a good ranking in search engines and design their pages accordingly. Spamdexing refers exclusively to practices that are dishonest and mislead search and indexing programs to give a page a ranking it does not deserve." [source]

In a recent article "Google Cleans Up Returns; Yahoo Not So Much" it states: "For instance, on Nov. 29 Benedini searched for the word "giubbotto" (Italian for "jacket") in .info domains and found that nearly all of the sites returned by Yahoo redirect to malware."

So I went to Yahoo and used the search terms defined and sure enough those results are truly infected with malware. What's not mentioned is that the malware (99.9%) were being hosts from the same IP Address ...

While the big search engines may have cleaned up the "search terms" they can do nothing about the Spamdexing itself. These culprit have posted malicious links in Forums, Guest Books, etc ... and as usual these posts are mainly to sites that have not updated their software making it easy for these culprits to continue with their evil activities ...

There are 437 sites listed on that one IP address and in checking each site shows up in a Google search with about 3500 results ... 437 sites x 3500 results = 1.5 million pages ... ouch!

As you can see they have posted malicious links in many different country's making this a world-wide problem ...and sadly in most cases these culprits use automated software to make these postings.

Thankfully my Antivirus (NOD32 from eSet) detected all the malicious links and blocked access to them ...

If you look closely you'll see a pattern in the ".js" files ... virtualy all the same. Since these sites are hosted in Russia it's doubful anyone will have much sucess in getting these sites shut down ...

Spamdexing to promote Malware

winhelp2002 — Fri, 31 Aug 2007 17:35:00 GMT

Spamdexing is becoming an ever increasing problem ... sadly with no letdown in sight. In this case these culprits purchase and set up a huge amount of what I call throw-away domain names. Then they use special software to post bogus topics to Forums that usually fail their software updated. Then search engine index these sites and ... well you can guess the rest.

In the above example you can see they use the names of famous female stars to entice you into clicking the (highlighted) link.
Google Results: 1 - 10 of about 175,000 (wow that's a lot of posting!)

Different female stars ... same trick ... click here to see a Movie from some site you never heard of ...
Google Results: 1 - 10 of about 128,000

Are these two sites related? you betcha! But not just two sites, there are 149 sites hosted on this server. And every one of them redirects to a Trojan.Codec site. If a certain Trojan.Codec site gets shut down, they simply redirect you to a different site, so the link Spammed to all these Forums remains valid.

Now you take the amount of posts per domain name and multiply that by the amount of sites just running on this one server and you can see why Spamdexing is such a problem.

Hosts News : Spamdexing

Is Spamdexing on the rise?

Spamdexing to promote Malware