Juice: A Longitudinal Study of an SEO Botnet

Black hat search engine optimization (SEO) campaigns attract and monetize traffic using abusive schemes. Using a combination of Web site compromise, keyword stuffing and cloaking, a SEO botnet operator can manipulate search engine rankings for key search terms, ultimately directing users to sites promoting some kind of scam (e.g., fake antivirus). In this paper, we infiltrate an influential SEO botnet, GR, characterize its dynamics and effectiveness and identify the key scams driving its innovation. Surprisingly, we find that, unlike e-mail spam botnets, this botnet is both modest in size and has low churn—suggesting little adversarial pressure from defenders. Belying its small size, however, the GR botnet is able to successfully “juice” the rankings of trending search terms and, during its peak, appears to have been the dominant source of trending search term poisoning for Google. Finally, we document the range of scams it promoted and the role played by fake anti-virus programs in driving innovation.