Recent Trends In Blackhat Spam SEO

This report describes an active Blackhat SEO campaign that pushes fake antivirus pages across many TLDs and IP addresses; actors use techniques such as random HTML whitespace, HTML entity encoding, JavaScript obfuscation (while leaving CSS unobfuscated), and JavaScript-based redirections to evade signature-based detection. The post also notes increased participation from multiple malicious actors and frequent churn of malicious domains, with .IN domains prominent recently, and provides example domains and IPs as indicators.