MANILA, Philippines — Ahead of the May 2022 election, Rappler and a number of other Philippine news websites found themselves at the end of increased distributed denial of service (DDoS) attacks.
A number of newsrooms including ABS-CBN News, GMA News, Rappler, Philstar, Vera Files, Altermidya, Bulatlat, CNN Philippines were affected by the attacks. At its peak, newsrooms struggled to keep their websites running while readers attempting to access the affected websites were served 403 or 404 errors.
This was not the first time media organizations in the Philippines have been attacked. Before the DDoS attacks, newsrooms and journalists on social media faced smear campaigns from pro-Duterte government social media influencers and social media propaganda channels.
To uncover the attackers, we worked with the Sweden-based digital forensics non-profit organization Qurium Media to examine data from the floods to Rappler, ABS-CBN and Vera Files. Qurium found that one of the methods used by the botnet – the network of devices used to launch the cyberattacks – was to tap into several thousand domains classified as “referrer spam”.
Referrer spam is a black hat digital marketing technique in which a website is flooded with fake visits from fake referrer URLs in order for them to appear in the target website’s traffic logs.
According to industry insiders, the goal of spammers is to grab webmasters’ attention and get them to click on the URLs in their analytics dashboard.
This is abusive behavior as it slows down the landing page and consumes resources without actually resulting in any pageviews. On a large scale and depending on how robust the landing page’s hosting system is, this can cause websites to go down. This happened in the case of the editorial offices affected by the DDoS attacks.
More importantly, this further deprives the public of verified and valuable information that memes and fake news are already burying. One of the incidents of these cyber attacks was staged while media groups were busy covering the aftermath of Typhoon Odette in the Visayas. Another attack was launched in the middle of a presidential debate.
New attacks
DDoS attacks on Rappler and most news sites have since died down. Our tech team managed to implement a number of mitigation measures to prevent the botnets from shutting us down. We have also published stories exposing potential actors behind the attacks.
But it’s wishful thinking to think they’ve stopped planning the next round of attacks.
In late July, while investigating a sudden drop in traffic from search results, Rappler discovered thousands of backlinks from what a search monitoring tool flagged as “toxic domains.” These are websites created through automated link building programs, often of poor quality and with very little content.
The tool found that over 1,300 of those referring domains, which have very high toxicity scores, bombarded the site with a “suspicious number of backlinks.”
Impact of negative SEO
Linking is encouraged by website owners. In fact, news websites – because they usually produce regularly updated, unique, credible, and informative content – rank well in search results because they naturally get a lot of backlinks.
But numerous links coming from toxic spam sites is another story. Failure to enable this may result in a drop in traffic to these target or affected websites.
This is a double blow to news sites, which are already struggling with losing traffic to Facebook, which has steadily deprioritized news sites in its news feed for the past few years.
News websites affected
The majority of the backlinks to the news sites surveyed came from low-authority sites. This isn’t necessarily a bad thing, as some newly created websites may only be starting to gain authority and quality backlinks.
What is alarming are signs that a significant number of backlinks are coming from potential spam sites.
An initial scan of backlinks to other Filipino news sites revealed that Rappler isn’t the only one being targeted by link spammers. Indications of potential spam attacks were found in relation to links to the ABS-CBN News, Philstar and Vera Files websites.
In the case of Rappler, the tool also uncovered 64,295 domains that may have the same IP addresses, the same Google Analytics IDs, the same Adsense IDs, the same URL paths, the same page title domains, multiple same root subdomains, or linked together could flip pages. Backlinks with these markers can signal link networks, according to Tool. It was also said that this could also be a sign of a spam attack.
In total, these potential spam domains created 400,351 backlinks targeting Rappler.
Of these domains, 50,452, totaling 221,067 backlinks to Rappler, have very low authority scores. Another 2,170 domains of these domains, totaling 10,676 backlinks, have very high toxicity scores.
In Philstar’s case, 52,558 domains with a total of 357,889 backlinks carry the markers of potential link networks. Of these, 38,593 domains with a total of 177,697 backlinks have very low authority scores, while 1,196 domains with 5,772 backlinks have very high toxicity scores.
In the case of Vera Files, Facebook’s other Philippine third-party fact-checking partner, it found 17,753 backlinks, of which a total of 10,065 came from 2,179 potential spam domains. Of those linkbacks, 3,743 came from 1,373 domains that have very low authority domains. A total of 102 of those linkbacks came from 29 toxic domains.
Poor quality to no content
Backlink data for Rappler, ABS-CBN News, and Philstar shows that some of the top referring domains, which are sites from which most backlinks come, have over 500 backlinks to these news sites.
A quick check of the “toxic” sites showed that many of the URLs linking back from these domains have either no content or very little content. In cases where the pages had content, the content was either incomprehensible or clearly generated by automated content-spinning techniques. This means that these are not real articles or real content at all.
Most of the pages found to link back to Rappler and Philstar were not even visibly linked. Instead, they abuse website resources by “hotlinking” or by directly rendering images of these websites on their web pages. Below are examples of these websites.
Hotlinking is also considered abusive and is similar to stealing as it not only uses a target website’s assets but also consumes that website’s bandwidth. In short, the target website owner bears the server costs without necessarily benefiting in the form of monetizable page views. It may also violate copyrighted material.
One of the keywords targeted by toxic backlinks on the Rappler website is the “crowdfunding” keyword. What is important here is that instead of linking to Rappler’s crowdfunding page, the spam pages link to non-existent subdomains on Rappler.
Similar abusive spam links targeted strange keywords on the ABS-CBN News, Philstar, and Vera Files websites.
The links below targeted the keywords “6841 philstar.com” on Philippine Star’s website. A quick search on Google reveals that Philippine Star does not appear to have this content.
This type of spam attack was also reported on the ABS-CBN News website with the keyword “5651. Abs-cbnnews.com.”
Some of the spam websites have been flagged as potentially dangerous by Google Chrome. Below is a screenshot of one of the sites spamming the site of Vera Files, one of Facebook’s two Philippine third-party fact-checking partners.
Election ramp up?
Exactly when the spam operations began is difficult to determine. Quick checks with the SEO Audit tool showed that a number of these toxic backlinks were “new”.
One indicator is the growth in the ratio of referring domains to backlinks, which went through the roof at both Vera Files and Rappler from November 2021 to June 2022.
Previously, the number of backlinks had grown at a fairly similar pace as the growth in the number of referring domains – an indicator of a healthy and organic link generation pattern that naturally comes from quality and credible content.
The fact that traffic to news websites tends to increase as election coverage increases may partly explain this. But a closer look at the top reference domains that contained the identified toxic pages showed that this does not fully explain this level of link building just before the election. It is possible that this was the period in which websites that the tool described as having “a suspiciously high number of backlinks” accumulated.
This period also coincides with the period when Filipino newsrooms were subjected to numerous intense DDoS attacks.
A website would not normally have that many backlinks to another website unless they are affiliated or work together. Examples of this included backlinks to Vera Files from Tsek.PH, an election-related collaborative fact-checking effort. Rappler has also linked heavily to the newsroom websites it has worked with as part of the #FactsFirstPH initiative. An indicator that would show this is related content that would explain the cross-references, as in the cases mentioned.
Rappler found that some low-quality Vera Files domains with between 100 and 300+ backlinks were targeting the fact-checking group’s website. Notably, the content from these domains was not even related to the typical content on Vera Files.
A series of toxic domains bombarded ABS-CBN News, Philstar, and Rappler websites, each with up to 500+ backlinks.
Shifting attack tactics?
When we investigated these cyberattacks, Tord Lundström, technical director at Qurium Media, noted that using referral spam for DDoS was “a very specific signature” that isn’t often seen in typical denial of service attacks. “You need a lot of IP addresses and a lot of URLs to generate that kind of traffic.”
He concluded that the attack’s masterminds likely hired one of the existing blackhat SEO operations that has access to this different type of business.
Google discourages spam link referrals. It is not in the interest of the affected news websites to engage in this practice, both because of the impact on server resources and the resulting penalties they could face if found to be engaging in manipulative link building participate in schemes.
The question is what do these attackers get out of it?
Sabotage
Many of these potential spam websites were built using free services like Netlify, Firebase, and Blogspot. But that doesn’t mean that the whole spam campaign wasn’t in vain.
On the one hand, tools have to be purchased. The backlink building software that Rappler found costs about 5,500 pesos. A tool that allows breaking captcha mechanisms that are designed to prevent automated mechanisms for account creation costs around 7,700. Another auto content generation tool costs another P7,400.
But even if the tools are already available, building those websites and backlinks—on the scale that’s been done here—still takes a tremendous amount of time and effort.
Considering possible penalties for unethical link building schemes, using these techniques is clearly of no use to the news sites concerned.
Since many of them don’t even have any content or bad content, it’s doubtful whether the creators of the websites are able to monetize them through advertising like they used to do in the past. Some of the pages we found didn’t even have ads. Below is an example.
Since the spammers themselves could derive very little value from the sites we detect, the only obvious purpose of the spam backlinks is sabotage.
Unfortunately, unless search giants recognize it as a threat to the information ecosystem, the only way to thwart these spam attacks is constant monitoring – something many newsrooms in the country don’t have the resources to do. – Rappler.com
Who is the first husband of Rio Diaz?
Diaz, like her first husband Hajji Alejandro, was a supporter of former President Ferdinand Marcos even after his ouster in the people power revolution. She was elected Vice Mayor of Pontevedra, Negros Occidental in the 1998 election while her husband won a seat in Congress.
Who is Gloria Diaz’s daughter? Isabelle Diaz Daza-Semblat (born March 6, 1988) is a Filipino actress, television host and model. She is the daughter of Miss Universe 1969 winner Gloria Diaz.
Who was Rio Diaz husband?
What happened chat silayan?
She was pronounced dead on Sunday after 7 p.m. (April 23) at St. Luke’s Medical Center, where she was confined for nearly three months, during which Chat fought an undaunted battle with colon cancer with stoic determination.
Is Rio Diaz dead?
.
Who is the father of the daughter of China Jocson?
Jocson is the daughter of Robert Capili (deceased), a trustee of Zuellig Pharma Corporation.
How did Charlie China meet Jocson? It turns out that Charlie and China first met 17 years ago in the wake of Charlie’s late wife, Rio Diaz. China was then a journalist writing a story, and she interviewed Charlie – but because that moment was overshadowed by sadness, that first meeting was long forgotten.
How did Charlie meet China Jocson?
It turns out that Charlie and China first met 17 years ago in the wake of Charlie’s late wife, Rio Diaz. China was then a journalist writing a story, and she interviewed Charlie – but because that moment was overshadowed by sadness, that first meeting was long forgotten.
Who are Charlie and China Cojuangco? Charlie is the incumbent Congressman for Tarlac’s First District, while China is a crisis management strategist and former assistant to the President’s spokesman. TARLAC First District Representative Carlos “Charlie” Cojuangco has passed away, his wife confirmed on Tuesday, February 22, 2022.
When did Charlie Cojuangco marry China Jocson?
She and Tarlac 1st Circuit Representative Carlos “Charlie” Cojuangco were married on April 7, 2021. She has a daughter from a previous relationship.
Who is the 1st husband of China Jocson?
Abadooo!! China Jocson is the former assistant to former presidential spokesman Ernesto Abella. Before marrying China, she married Rio Diaz, although their relationship ended in 2004. Daughter Claudia Cojuangco and son Jaime Diaz Cojuangco.
How did China Jocson meet Charlie Cojuangco?
Kei Tiu Laurel was the ignorant bridge for China and Charlie. She and China were hanging out at their house when Charlie came over with Kei’s father, Kiko. Charlie then called China the next day, claiming that he needed Kei’s number because he wanted to order beef from her. They started chatting and got along so well.
Where is Rio Diaz?
Rio was diagnosed with stage 4 colon cancer in December 1998. She had three months to live then, but had lived six years. She died on October 4, 2004 at Seton Hospital in Daly City, California at the age of 45.