MANILA, Philippines – Prior to the May 2022 elections, Rappler and several other Philippine news sites found themselves on the receiving end of distributed denial-of-service (DDoS) attacks.
Several newsrooms, including ABS-CBN News, GMA News, Rappler, Philstar, Vera Files, Altermidya, Bulatlat, CNN Philippines, were affected by the attacks. At its height, newsrooms struggled to keep their sites alive while readers trying to access affected sites received 403 or 404 error messages.
This is not the first time media organizations in the Philippines have been attacked. Prior to the DDoS attacks, newsrooms and journalists were subjected to smear campaigns on social media by pro-Duterte social media influencers and social media propaganda channels.
To unmask the attackers, we worked with Qurium Media, a digital forensics organization based in Sweden, to investigate flood data for Rappler, ABS-CBN and Vera Files. Qurium found that one of the methods used by the botnet – the network of devices used to launch the cyberattacks – included touching several thousand domains classified as “referral spam”.
Referral spam is a black hat digital marketing technique that involves flooding a website with fake visits from fake referral URLs in order for them to appear in the target website’s traffic logs.
The goal of spammers, according to industry experts, is to grab the attention of webmasters and encourage them to click on the URLs in their analytics dashboard.
This is abusive behavior as it slows down the target site and consumes resources without actually resulting in page views. On a large scale, and depending on the robustness of the target website’s hosting system, this can cause websites to go down. This happened in the case of newsrooms affected by DDoS attacks.
More importantly, this further deprives the public of verified and valuable information, which is already being buried by memes and fake news. One of the incidents of these cyber attacks was staged while media groups were busy covering the impact of Typhoon Odette in the Visayas. Another attack was launched in the middle of a presidential debate.
New attacks
Contents
DDoS attacks on Rappler and most news sites have been phased out. Our technology team was able to implement a number of mitigation measures to prevent botnets from bringing us down. We also publish stories exposing possible actors behind the attacks.
But it is an illusion to believe that they have stopped planning the next round of attacks.
In late July, while investigating a sudden drop in traffic coming from search results, Rappler discovered thousands of backlinks from what was flagged by a search monitoring tool as “toxic domains”. These are sites built through automated link building schemes, often of low quality and with very little content.
The tool found that over 1,300 of these referring domains, which have very high toxicity scores, are flooding the site with a “suspicious number of backlinks.”
Impact of negative SEO
Staying linked is wanted by website owners. In fact, news sites – because they often regularly produce up-to-date exclusive, reliable, and informative content – rank well in search results because they naturally get a lot of backlinks.
But countless links coming from toxic and spammy sites is a different story. If left unchecked, this can reduce traffic to targeted or affected sites.
This is a double whammy for news sites already struggling with the loss of traffic from Facebook, which has consistently de-prioritized news pages in its news feed for the past few years.
News websites affected
Most of the backlinks to the news sites examined were from low authority sites. This isn’t necessarily a bad thing, as some newly created sites may just be starting to gain authority and quality backlinks.
What is alarming are the indicators that a substantial number of backlinks are from potential spam sites.
An initial scan of backlinks to other Philippine news sites revealed that Rappler is not the only target of link spammers. Signs of potential spam attacks were found in links to the ABS-CBN News, Philstar and Vera Files websites.
In the case of Rappler, the tool also discovered 64,295 domains that could potentially be linked to each other via the same IP addresses, same Google Analytics IDs, same Adsense IDs, same URL paths, same page title domains, multiple same root subdomains or spreads. Backlinks with these markers, according to the tool, can signal networks of links. He further said that this could also be a sign of a spam attack.
In all, these potentially spammy domains created 400,351 backlinks directed to Rappler.
Of these domains, 50,452, representing a total of 221,067 backlinks to Rappler, have very low authority scores. Another 2,170 domains from these domains, representing a total of 10,676 backlinks, have very high toxicity scores.
In Philstar’s case, 52,558 domains, totaling 357,889 backlinks, carry the markers of potential link networks. Of these, 38,593 domains that account for a total of 177,697 backlinks have very low authority scores, while 1,196 domains that account for 5,772 backlinks have very high toxicity scores.
In the case of Vera Files, Facebook’s other Philippine third-party fact-checking partner, 17,753 backlinks were found, of which a total of 10,065 were from 2,179 potential spam domains. Of those linkbacks, 3,743 came from 1,373 domains that have very low authority domains. A total of 102 of these linkbacks are from 29 toxic domains.
Poor quality to no content
Backlink data for Rappler, ABS-CBN News, and Philstar shows that several of the top referring domains, i.e. sites from which the most backlinks originated, have over 500 backlinks to these news sites.
A quick review of “toxic” sites showed that many of the URLs linking to these domains have no or very little content. In cases where pages had content, the content was either unintelligible or clearly produced through automated content-spinning techniques. That means they are not real articles or real content.
Most pages found linking to Rappler and Philstar had no visible links. Instead, they were abusing the site’s “hotlinking” features or directly rendering images from those sites on their web pages. Below are some examples of these sites.
Hotlinking is also considered abusive and similar to theft because it not only uses a target website’s assets but also uses that website’s bandwidth. In short, the owner of the target site bears the server costs without necessarily benefiting in terms of monetizable page views. It also potentially infringes on copyrighted material.
One of the keywords that toxic backlinks have been targeting on the Rappler site is the keyword “crowdfunding”. What is significant here is that instead of linking to Rappler’s crowdfunding page, spam pages link to non-existent subdomains on Rappler.
Similar abusive spam links target strange keywords on the ABS-CBN News, Philstar, and Vera Files websites.
The links below targeted the keywords “6841 philstar.com” on the Philippine Star website. A quick Google search shows that Philippine Star doesn’t seem to have this content.
This type of spam attack has also been observed on the ABS-CBN News website using the keyword “5651. Abs-cbnnews. with.”
Some of the spammy sites have been flagged by Google Chrome as potentially dangerous. Below is a screenshot of one of the sites spamming the site of Vera Files, one of Facebook’s two Philippine third-party fact-checking partners.
Election ramp up?
It is difficult to detect when exactly the spam operations started. Quick checks using the SEO audit tool showed that several of these toxic backlinks were “recent”.
One indicator is the growth in the ratio of referring domains to backlinks, which peaked from November 2021 to June 2022 in the case of Vera Files and Rappler.
Prior to that, the number of backlinks had been growing at a very similar rate to the growth in the number of referring domains – an indicator of a healthy, organic link generation pattern naturally derived from quality and credible content.
The fact that traffic to news sites tends to increase as election coverage heats up may explain this in part. But a closer look at the top referring domains, which included the identified toxic sites, showed that this doesn’t fully explain this level of link accumulation around elections. It is possible that this was the period when there was a buildup of sites that the tool described as having a “suspicious number of backlinks”.
This period is also right at the time when Filipino newsrooms were being subjected to various intense DDoS attacks.
A site would not normally have as many backlinks to another site unless they are partners or collaborating with each other. Examples of this were backlinks to Vera Files by Tsek.PH, a collaborative election-related fact-checking effort. Rappler has also heavily linked the websites of newsrooms it has collaborated with under the #FactsFirstPH initiative. An indicator that would show this is the related content, which would explain the crossover, as in the cases cited.
Rappler found that some low-quality domains for Vera Files targeted the fact-checking group’s website with between 100 and 300+ backlinks. What is significant is that the content on these domains was not even related to typical Vera Files content.
Several toxic domains invaded the ABS-CBN News, Philstar and Rappler websites with over 500 backlinks each.
Shifting attack tactics?
At the time we investigated these cyberattacks, Tord Lundström, Technical Director at Qurium Media, noted that the use of referral spam for DDoS was “a very specific signature” not often seen in typical denial-of-service attacks. “You need a lot of IP addresses and a lot of URLs to create this kind of traffic.”
He concluded that those responsible for the attack likely hired one of the existing blackhat SEO operations that has access to this other type of business.
Spammy link references are discouraged by Google. It is not in the interests of the news sites involved to engage in this practice due to the impact on server resources and the resulting penalties that can be imposed on them if they are found to be involved in manipulative link building schemes.
The question is what do these attackers get by doing this?
Sabotage
Many of these potentially spammy sites were produced using free services like Netlify, Firebase and Blogspot. But that doesn’t mean the entire spam operation wasn’t cost-free.
On the one hand, tools need to be purchased. The backlink building software that Rappler found costs around P5,500. A tool that allows you to break captcha mechanisms intended to avoid automated account creation mechanisms costs around 7,700. Another tool for automatically generating content costs another P7,400.
But even though the tools are already available, building these sites and backlinks – on the scale that was done here – still takes a lot of time and effort.
Considering possible penalties for unethical link building schemes, using these techniques is clearly not good for the news sites in question.
As many of them don’t even have content or have bad content, it is doubtful that website builders will be able to monetize them through advertising as they normally did before. Some of the pages we found didn’t even have advertising. Below is an example.
Since there is very little other value that spammers themselves can get from the sites we’ve discovered, the only apparent purpose of spammy backlinks is sabotage.
Unfortunately, unless the search giants recognize this as a threat to the information ecosystem, the only way to defend against these spam attacks is constant monitoring – something many newsrooms in the country don’t have the resources for. – Rapper. with
Is China Jocson married?
How did Charlie meet China Jocson? It turns out that 17 years ago, Charlie and China met during the wake of Charlie’s late wife, Rio Diaz. China was then a journalist doing a story, and she interviewed Charlie – but because that moment was marked by sadness, that first meeting was long forgotten.
Who is Charlie Cojuangco’s new wife?
For example, newlyweds Charlie and China Cojuangco originally wanted their church wedding date to be April 14, which is the groom’s birthday. The civil wedding, held on April 7, was from China, so it’s a truly meaningful month for them.
Who is China Jocson wife of Charlie Cojuangco?
Carlos “Charlie” Cojuangco has died, his wife Czarina Maria “China” Jocson confirmed in a Facebook post Tuesday, February 22. Charlie, on the other hand, is a widower, who has been single since the death of his first wife Rio Díaz-Cojuangco in 2004.
How did China Jocson meet Charlie Cojuangco?
Kei Tiu Laurel was the unconscious bridge to China and Charlie. She and China were hanging out at her house when Charlie came over with Kei’s father Kiko. Charlie then called China the next day, on the pretext that he needed Kei’s number because he was going to order meat from her. They started talking and got along great.
Who is the 1st husband of China Jocson?
| China Jocson | |
|---|---|
| Spouse(s) | Carlos “Charlie” Cojuangco â â (d. 2021; died 2022)â |
| Children | 1 |
| Education | University of Pennsylvania (assisted) |
Who is China Cojuangco wife?
China and Charlie were first married in a civil wedding ceremony in April, while having an “engagement ceremony” in January. from 07/09/21. His wife, China Jocson-Cojuangco, whom he only married in October last year, made the announcement on Facebook. .
Who is the first husband of Rio Diaz?
Diaz, similar to her first husband Hajji Alejandro, was a supporter of former President Ferdinand Marcos, even after his ouster in the People’s Power Revolution. She was elected deputy mayor of Pontevedra, Negros Occidental in the 1998 elections, while her husband won a seat in Congress.
Who is Gloria Diaz’s daughter? Isabelle Diaz Daza-Semblat (born March 6, 1988) is a Filipino actress, television presenter and model. She is the daughter of Miss Universe 1969 titleholder Gloria Diaz.
Who is Gino Gonzalez?
Gonzalez is the son of famous chef Gene Gonzalez, while Cojuangco is the daughter of the former governor of Tarlac, Tingting Cojuangco. They have a four-month-old daughter named Lucia Margaret Ysabel. Gonzalez and Cojuangco share a passion for cooking.
Who is Chef Gino Gonzales? He is also a gastronomic writer/editor and author of the book “Cocina Sulipena”. His son, Chef Gino, is an instructor of recreational and professional classes at the Center for Asian Culinary Studies; Executive chef at Café Ysabel, USDA certified chef.
Who is the father of the daughter of China Jocson?
Jocson is the daughter of Robert Capili (deceased), administrator of Zuellig Pharma Corporation.
