Ubiquitous SEO Poisoning URLs

**Executive summary:** ThreatLabZ analyzed a widespread SEO poisoning campaign that has compromised thousands of websites and generated tens of thousands of search-optimized URLs to rank for trending terms (example: “midterm elections”), using cloaking, CSS-induced reloads and multi-stage 302 redirects to evade crawlers and funnel users to MaaS redirectors, exploit servers, adware/malware, adult sites and malicious advertising; the report documents generation patterns, redirect chains, scale (10,000+ compromised sites, 15,000+ keywords, ~3,000 new poisoned URLs daily) and provides IOCs for detection and remediation.