Stealthy Parasites: Uncovering and Analyzing Reflected Search Poisoning for Illicit Promotion

As an emerging black hat search engine optimization (SEO) technique, reflected search poisoning (RSP) allows a miscreant to free-ride the reputation of high-ranking websites, get search engines poisoned with illicit promotion texts (IPTs) in an efficient and stealthy manner, while avoiding the burden of continuous website compromise as required in traditional promotional infections. However, the scale, scope, and impact of this threat remain poorly understood. To bridge this gap, we present the first comprehensive measurement study of RSP-driven illicit promotion, enabled by a novel end-to-end methodology to capture, analyze, and infiltrate IPTs. Our study reveals that RSP-based illicit promotion is both large-scale and continuously growing, encompassing a diverse range of illicit categories and languages. Particularly, we have identified over 17 million distinct IPTs spanning 14 illicit categories, including drug trafficking, data theft and hacking services. These campaigns have abused tens of thousands of high-ranking websites (including 26% of the top 10K most popular sites) and have extensively poisoned all four major search engines we studied, particularly Google and Bing. Furthermore, it is also observed that benign search users are being exposed to IPTs at a concerning extent. Also, to interact with potential customers, adversaries embed various contact methods, primarily instant messaging accounts, within the IPTs. Infiltrating these contacts uncovered the massive operational scale of these campaigns: from 92K extracted contacts, we identified 2,333 Telegram channels with 29M subscribers and 661 Telegram groups with 606K distinct members. All these results underscore the severe security implications of RSP, and thus call for more efforts to be invested to mitigate RSP-driven illicit promotion.