Popular Web Sites Still Getting Gamed in SEO Attacks

Akamai researchers describe a large-scale SEO abuse campaign that leveraged open redirect vulnerabilities on high-ranking websites to boost the reputation and search ranking of ~10,000 malicious sites and to redirect users to malware- or credential-phishing pages. The distributed operation used over 3,400 source IPs (many via proxies/VPNs/cloud services), compromised more than 4,000 web applications, persisted for at least 30 days, and the report urges community action (benchmarks, WAF rules and redirect validation) to mitigate and measure the problem.