4 ms·
I'm trying to understand this. What benefit do those bots get from "poisoning the query log"? And what benefit do they get from "spamming every endpoint ... wi
by TekMol 4y ago
I'm trying to understand this.
What benefit do those bots get from "poisoning the query log"? And what benefit do they get from "spamming every endpoint ... wired up to Google or Bing"?
- seszett 4y agoThey try to make some searches seem more popular than they actually are, maybe to manipulate the rates of some ad keywords.
- marginalia_nu 4y agoHonestly, I'm not 100% sure about how the attack vector looks. The fact of the matter is they're basically spamming very specific search queries and not really looking at the results. But most larger search engines store and analyze search queries to for example produce typeahead suggestions or error corrections. You can conceivably poison this data to manipulate how a search engine operates, perhaps directing users to your website or affecting ad auctions. I think the benefit of not directly spamming Google or Bing is that they're harder to identify.
- TekMol 4y agoHow many of these requests do you get per day?
- marginalia_nu 4y agoSeems to be about a million queries/day right now. Varies a bit though. Peak figures is probably around the neighborhood of 10 mn/day.
- tedivm 4y agoI've been running my own website since the early 2000s and while there have been occasional issues I've never felt the need to use cloudflare.
- marginalia_nu 4y agoProbably depends on what sort of website you're running. I wouldn't use it for my blog or anything that's reasonably static. But this is a publicly available Internet search engine we're talking about. There's slightly more processing involved in processing a search query than loading a static file off a filesystem.
- deleted 4y ago[deleted]
- nibbleshifter 4y agoBlackhat SEO methods are often a bit fucking daft. So what's happening here could be one of two things: Link injection, where by spamming an endpoint with a URL they hope the URL will end up indexed and displayed somewhere on the site, for a search engine to pick up later. Often with some keywords in the link text, etc. The idea is to boost pagerank. The other is even sillier: they try search for their own sites a tonne on third party search things that probably query a "real" search engine, to try artificially boost the supposed popularity/keyword associations of their sites, boosting pagerank. A lot of blackhat SEO stuff us bunkum and snake oil. Every so often they figure out a working method to exploit search engines to boost pagerank, and then it gets fixed. But they never stop trying even the most obsolete methods as the automated scripts are what they have available.
- MandieD 4y agoOh, so that’s how a very niche amateur radio-related query can turn up a plausible-looking result in Google on a subdomain of some unrelated, not carefully-tended domain, but actually link to a page of spam.
- thomastjeffery 4y agoThe entire category of "blackhat" isn't going through a filter of "this makes no sense, so don't bother". The only place that filter exists is where people actually communicate openly about their strategies.
- BeFlatXIII 4y ago> But they never stop trying even the most obsolete methods as the automated scripts are what they have available. As described on the Security Now podcast, this is now part of "internet background radiation"