Suspicious website spamming PH newsgroup traced to Swedish black hat SEO operator

The Questionable Business of Black Hat SEO Marketing

Part 2 of 2

MANILA, PHILIPPINES – In Part 1, we explained how we tracked down the identity of a black hat SEO marketer whose web site has been spamming Rappler, ABS-CBN News, and Philstar’s sites.

We partnered with the Swedish digital forensics organization Qurium Media to track the identities of black hats through the historical domain registration records of one of the websites that were rated by SEO monitoring tools as highly toxic or possibly part of a link building program.

The domain name of this website is registered by the Swedish Richard Genmar and shares the same hosting server (IP address 78.69.18.135) with more than 500 other websites. Most of these sites use the same title: “The Globe – The World’s Most Visited Web Page”. Hundreds of websites from the same IP address were found in the backlink data to the aforementioned Philippine newsgroup.

Black hat infrastructure. Over 500 suspicious websites link to IP address 78.69.18.135.

While the website hosted by this IP address is not functionally complex and looks dated, there is no doubt that it takes some effort and resources to build the entire infrastructure, let alone maintain it.

However, the potential rewards are huge. Windfalls can range from tens of thousands to millions of dollars, assuming targeted payments.

The Philippine news site is not the only one targeted by the Globe. In a report to Google’s Search Console help site, a webmaster also reported an issue with spam links from theglobe.net.

According to the webmaster who reported the issue, they contacted The Globe several times to ask them to remove the backlink, but only received an automatic response. “We also asked them to pay to remove the URLs, but they didn’t respond, my assumption is that competitors have paid to add those links but can’t remove them now.”

We sought a side of Genmar and The Globe by emailing at their published email addresses. We also asked if they would like to remove unwanted backlinks to Rappler’s website and other Philippine news sites for free. We have yet to receive a response to our question and will update this story once we do.

Infrastructure for Black Hat Marketers

To maintain a domain name, an annual fee must be paid to a domain registrar such as GoDaddy, which can range from $2 (P114.34)* to $20 (P1,143.46) to thousands of dollars per domain name, depending on the Requirements for keywords used in preferred domains.

Choosing a cheaper domain name still costs $1,000 (P57,172) to $10,000 (P571,828) per year to maintain 500 domains. This does not include the cost of hosting the website, which could be more.

The Globe doesn’t limit its business to self-hosted websites. While The Globe can’t connect to most of the blogs on Blogspot and Firebase that spam Rappler, there are indications that it has also been abusing these services to expand its site. For example, the blogspot website below backlinks to add-link.us, one of over 500 sites hosted on IP address 78.69.18.135.

Abuse blog. Backlink data shows a number of blogspot accounts associated with The Globe-owned infrastructure.
why us?

Why can Swedish black hat operators pursue more lucrative goals but choose to waste time and resources creating tens of thousands of backlinks to Philippine news sites? Are the people behind The Globe taking responsibility for these news sites themselves, or is someone else paying for the services they provide?

Black Hat SEO Operator Destroys PH News Site With Toxic Backlinks

As of the last check, the search monitoring tool had flagged 1,439 unwanted backlinks to Rappler from this particular cluster of sites. If all of that is paid, it looks like someone spent $4,317 (P246,817) to spam Rappler alone. On top of that, Philstar’s additional 1,256 backlinks will cost $3,768 (P215,435). Another 867 backlinks to ABS-CBN would cost $2,901 (P165,852).

If adding backlinks is expensive, it will be even more expensive to remove unwanted backlinks from websites operated by “The Globe”. The Globe also charges $36 to remove unwanted backlinks from its toxic site.

At this rate, three Philippine news sites would have to pay tens of thousands of dollars each to have The Globe remove backlinks from a cluster of sites that share the title “The Globe – The world’s most visited web pages.”

In Rappler’s case, the bill for 1,439 backlinks could be a staggering $51,804 (P2,961,677). For Philstar, 1,256 backlinks cost $45,216 (P2,585,139). Finally, for ABS-CBN News, 867 unwanted backlinks would be $31,212 (P1,784,487).

Black Hat racketeering scheme. The Globe charges websites an absurd $36 to remove unwanted backlinks from their website network.

We’re not even talking here about backlinks from other questionable sites, some of which link to this Swedish black hat network.

At that price, black hat operators could hold news site traffic hostage for hundreds of thousands to over a million dollars if all the backlinks to the three Philippine news sites are taken into account.

That’s an absurd number for an industry already struggling with lost ad revenue from internet giants.

Payments for The Globe website are made via Paypal to an entity called The Globe Enterprises. Data reflected on the website of the Swedish Companies Registry Bolagsverket indicates that the company is located in Stockholm County, Sweden.

Data published on the information portal Justia.com indicates that the trademark is intended for the following goods and services – “Website search engine services, i.e. providing search engines for the Internet”.

Obviously, the service of “Globe” has nothing to do with “providing a search engine for the Internet”.

Go after black hat marketers

What’s the next step after finding a black hat backlink spammer?

Unfortunately, determining who initiated the backlink spam operation is one thing. Holding these actors accountable for deterioration and trouble is another.

Because search optimization is an area that few people understand, there are practically no penalties for bad actors and their manipulation schemes.

Site owners can report these operators to Google, the world’s leading search engine, at any time, but Google itself is very secretive about how it handles reports related to manipulative links.

Negative SEO: How Black Hat Marketers Abuse Google's Rules With Toxic Backlinks

The only advice Google gives site owners about spam backlinks is that they should either remove these backlinks themselves, or report them through their disavowal tool.

However, the first suggestion assumes that the website owner is involved in a manipulative link building scheme.

As discussed in our previous story, backlinks are often desirable. However, black hat SEO marketers have been gaming the process with manipulative link building schemes. This sparked an arms race between Google and other search engines and these black hats. In effect, Google’s engineers had to constantly think about metrics that might identify a possible manipulation scheme.

On such a battlefield, victims of negative SEO attacks like Rappler and other Philippine news sites, become collateral damage.

Google’s webmaster guidelines explain a lot: “In some cases, incoming links can affect how Google sees a page or site. For example, you or an SEO you hire may use paid links or other links that violate our quality guidelines. The scheme builds bad links to your site. First, we recommend that you remove as many spam or low-quality links as possible from the web.”

This is obviously not possible with toxic backlinks to Philippine news sites.

Genmar and The Globe have yet to respond to our emails asking if they would consider removing backlinks that news organizations don’t need for free.

The only way a site owner can show Google that they have no complicity is through a disavowal process. In fact, site owners need to tell Google that they don’t recognize bad backlinks.

This process involves submitting a list of backlinks or domains for disapproval through Google Search Console, which is usually accessible to webmasters. By “rejecting” these backlinks, the webmaster tells Google that it doesn’t recognize backlinks listed, so search algorithms should ignore them.

Rappler has been going through this process since the discovery of spam backlinks.

However, Google reminds webmasters to use disavow sparingly, as legitimate backlinks may be disavowed in the process. Avoiding this requires mining massive amounts of backlink data, and it can take months to neutralize the impact of a negative SEO attack.

Anti-spam laws are generally related to email and do not include backlink spam.

Spam is not even illegal in the Philippines. In the 2014 case of Disini, Jr. v. Attorney General concerning the Cybercrime Prevention Act of 2012, the Supreme Court of the Philippines stated that unsolicited commercial communications or spam are “lawful forms of expression.” The National Privacy Commission cited this in its October 2020 response to a letter author requesting an advisory opinion on this issue.

According to information and technology law expert JJ Disini, the closest thing that can be cited is the provisions of the Electronic Commerce Act regarding “interference” with computer systems or information and communication systems.

Without any clear penalties, the muddy waters of the World Wide Web will remain a playground for black hat operators. – with Bingbong Recto and Ogoy San Juan/Rappler.com and Tord Lundström, Qurium Media

*Conversion rate: $1 = P57.18

Leave a Comment

Your email address will not be published.