Strider Search Ranger:
War on Search Spam: Shifting the Battleground by “Following the Money”
Created: January 2007
Last Updated: March 30, 2009
Recent Last Update: January 28, 2010
· “Detecting Stealth Web Pages That Use Click-Through Cloaking,” MSR-TR-2006-178, December 2006
· “Spam Double-Funnel: Connecting Web Spammers with Advertisers,” in Proc. WWW, May 2007
o “Researchers Track Down a Plague of Fake Web Pages,” by John Markoff, The New York Times, March 19, 2007
o “Microsoft Tracks Down Mass Fake Web Pages,” Slashdot, March 20, 2007
o “Microsoft researchers follow Web spam money trail,” by Ryan Naraine, ZDNet, March 19, 2007
o “Research paper uncovers root of nuisance Web pages,” by Jeremy Kirk, IDG News Service, London Bureau, March 19, 2007
o Chris OHara’s Jan. 23, 2007 blog on his contact with ISPrime regarding the involvement of 126.96.36.199 in comment spamming
o How you can help fight search spam by “following the money” (download the Fiddler HTTP proxy first):
1. If you are a blog owner like Chris and your blog is being spammed by cyber-scammers who serve ads:
· Turn on Fiddler to monitor the HTTP traffic.
· Click on an ad on the spam page and watch Fiddler output to see which IP addresses and domains are receiving (and therefore profiting from) spam-ads click-through traffic; for example, the first Fiddler screenshot at http://research.microsoft.com/SearchRanger/Spam_ads_click-through_analysis.htm shows that the IP address 188.8.131.52 and the domain looksmart.com are involved.
· Do a Whois lookup at http://whois.domaintools.com/184.108.40.206, find out that it is hosted by ISPrime, Inc., and call their abuse phone number to report the spam. Any responsible ISP would respond immediately by removing the spammer because they don’t want to be knowingly involved in making money from spam.
· Do a Whois lookup at http://whois.domaintools.com/looksmart.com to find looksmart.com’s phone number and call them to report the spam. Any responsible advertising syndicator would respond immediately by disabling the spammer’s account because they don’t want to be knowingly involved in making money from spam.
2. If you are a legitimate company like Orbitz and you don’t want to have the bad reputation of funding the search-spam industry:
· Use the following queries to find lots of spam pages and click on the orbitz.com ads to see which ISPs and syndicators are responsible:
Call the ISPs to complain. Call the syndicators to complain. Who knows, they may apologize and give you a big discount on the rest of your good ad impressions. If they had explicitly promised you that they would not serve your ads on low-quality pages, there may be more actions you can take. (Note: to verify that a suspicious-looking page like http://zcheapticket.blogspot.com is indeed a comment-spammed URL, do a query of “link:http://zcheapticket.blogspot.com” at live.com and visit the cached pages to see where the URL is being spammed.
3. If you are a legitimate ISP like ISPrime, Inc. and you don’t want to have the bad reputation of making money from search spam:
· Do the following queries, visit the cached pages of those spammed forums, pick a few blogspot spam URLs to visit, click on the spam ads, and you can easily see how much of the click-through traffic is going into ISPrime-hosted IP addresses like 220.127.116.11 and 18.104.22.168:
· More seriously, do the following queries to see malicious spam URLs that are exploiting browser vulnerabilities to install malware through an ISPrime-hosted IP address:
Many of these law.harvard.edu doorway pages redirect to the malicious domain stlinx.info sitting on the ISPrime-hosted malicious IP address 22.214.171.124. This IP address has been hosting several generations of malicious domains including (1) Alllinx.info/Linim.net, (2) Frdolls.net/Frlynx.info/Joutweb.net, (3) Stlinx.info/Recdir.org, and (4) Trfred.info (e.g., this malicious blogspot URL http:// bimanzj. blogspot. com redirects to http:// trfred. info/ lc22.html.)
· Looks like a lot of spam-ads click-through traffic is now moving to 126.96.36.199 hosted by Beyond The Network America, Inc.; see http://research.microsoft.com/SearchRanger/Spam_ads_click-through_analysis_March_11_2007.htm#Beyond.
· ISPs against Spammers:
· ISPrime took actions around March 19, 2007, and the spammer moved to 188.8.131.52 (and near-by IP addresses) – see http://whois.domaintools.com/184.108.40.206
4. If you are a legitimate advertising syndicator and you are considering doing business with IP addresses that are known to be involved in search spam (or you don’t want to do due diligence in stopping your partners/affiliates from doing that):
· Think twice, because you may be getting angry phone calls from some of your biggest advertising customers, now that everybody knows how the search-spam industry works. It’s just not worth it.
· For example, kanoodle.com did not have a heavy presence in our Spam Double-Funnel study. But we are now seeing kanoodle.com connecting to the double-funnel through 220.127.116.11.
· Syndicators against Spammers:
· LookSmart took actions around March 19, 2007 and wants to take more actions. As the first step, they should scrutinize click-through traffic from 18.104.22.168 and 22.214.171.124 (and their nearby IP addresses). For example, http://ch-airfares-hoo.blogspot.com, http://hometown.aol.com/allhandbags/index.html, and http://www.searchadv.com/search.php?aid=45034&q=cheap%20airfares.
5. If you are a search engine user and you see a list of ads AFTER you click on a search result:
· Don’t click on any of the ads on that page because you will be helping the spammer make money if you do that.
· Better yet, click on one of the ads with the Fiddler monitor on and call the involved domain owners to complain, as described in (1).
6. If you are a legitimate website owner:
· Beware of spam parasites like http://PornStar-Finder.IEEEpcs.org/ and http://www.HistMed.org/Gambling-Online.phtml.
· If you own law.harvard.edu, do a query of “site:law.harvard.edu phentermine” at live.com to discover search spam on your website.
· Spam Ads Click-Through Analysis Examples:
· “A Quantitative Study of Forum Spamming Using Context-based Analysis,” in Proc. NDSS, February 2007
o Honey Forums, Click-Through Cloaking, Universal Redirectors, and malicious spam pages
· “Strider Search Ranger: Towards an Autonomic Anti-Spam Search Engine,” in Proc. ICAC, June 2007
· Other Spam Analysis
· Other Strider Projects:
o Strider HoneyMonkey Malicious Website Detection
o Strider Typo-Patrol Cybersquatter Detection
o Strider GhostBuster Rootkit Detection
o Strider Gatekeeper Spyware Management