Monday, June 21, 2010

World Cup, Black Hat SEO list

Leading up to the World Cup, there were several Black Hat SEO instances poisoning specific World Cup search terms. Since the start of the World Cup however, I thought I'd seen less and less poisoned results make it into the top results when searching for World Cup phrases. This made me wonder if Google was doing a better job at removing or preventing these poisoned results from being delivered, or that the bad guys were shifting their focus to poison less obvious targets and stay under the radar (Google and the security community have been on alert for poisoned results for high profile events like the World Cup).

This morning I was able to view the files on a compromised website being used for a BlackHat SEO campaign and view over 1,000 some websites and search terms used in the BlackHat SEO back-linking. The poisoned search term list is large and diverse, but do include a number of World Cup related search terms, for example:

Ghana Vs Serbia
Germany Australia World Cup
Soccer Offside Rule
German National Anthem Youtube
Espn Soccer
Algeria Vs Slovenia
Germany Cup Roster
South Africa Time Zone
World Cup Schedule Printable
World Cup Inauguration 2010
World Cup Scores
Fifa Schedule
Ghana World Cup 2010
Usa Vs England World Cup
Espn World Cup Schedule
Germany Australia World Cup Date
World Cup 2010 Bracket
Ghana World Cup 2010 Fixtures
German Soccer Team Roster
Germany World Cup
Germany Soccer Team
World Cup Opening Ceremony
Uruguay Soccer Team
Espn World Cup Coverage
Australia Vs Ghana World Cup 2010
World Cup Live Streaming
Germany Soccer Team Apparel
Soccer Rules
German Soccer Team Logo
Mexico Soccer Team
The poisoning success of some of these terms varies, but in almost every case I was able to find a number of poisoned results. For example, World Cup 2010 Bracket had 3 of the top 10 results poisoned:
And Soccer Offside Rule had a number of poisoned results.
Following a poisoned result through the redirect to the badness (fake codec in this instance):
Virus Total result for this example was 12/41 A/Vs detect.

So a reminder in case you needed one, World Cup search terms are still being successfully poisoned.

1 comment:

shooflypie said...

Looks like the same spam as found at http://www.seotheoryandpractice.com/2010/06/spam-in-poisoned-world-cup-results.html ?