Scam Alert: SEO Poisoning & Typosquatting Scams

SEO Poisoning and Typo Squatting Allow Scammers to Hijack Search Listing Prominence from Legitimate Websites to Lure in Victims for any number of Scams, from Online Shopping Scams, Travel Scams, Financial Fraud and Scams, Government Impersonation, and many more!

In the online age, where the internet serves as a vast repository of information, we depend on search engines to help us find almost everything. The practice of Search Engine Optimization (SEO) is critical for websites to enhance their visibility and attract more visitors through helping them get better positions in search engine listings. However, amidst the legitimate efforts to improve search rankings lies two deceptive techniques known as SEO poisoning and Typo Squatting, employed by threat actors to deceive users and propagate malicious activities.

SEO Poisoning

SEO poisoning is a smart strategy used by scammers and cybercriminals to manipulate search engine results and elevate the visibility of their malicious websites.

By exploiting the human tendency to trust the top search results, these malevolent actors aim to make their fraudulent sites appear more legitimate and credible to unsuspecting users. The technique preys on individuals who often fail to scrutinize their search results closely, leading to potentially serious consequences such as credential theft, malware infections, and financial losses.

At its core, SEO poisoning capitalizes on the psychology of trust and convenience – in other words, it is Social Engineering

When users conduct online searches, they typically gravitate toward the top-ranked results, assuming them to be the most reliable and relevant sources of information. Cybercriminals exploit this inherent cognitive bias by employing various tactics to manipulate search algorithms and ensure that their malicious websites rank prominently among the search results. As a result, unsuspecting users may inadvertently click on these compromised links, unknowingly exposing themselves to cybersecurity risks.

It is important for you to understand that criminals have vast amounts of money and technical talent to do this. They can easily hijack the traffic from small and medium businesses, even governments for their purposes.

Typo Squatting (Typosquatting)

One of the primary methods used in SEO poisoning is typosquatting, a deceptive practice wherein cybercriminals register domain names that closely resemble legitimate ones. These fraudulent domains often contain slight variations or misspellings of popular websites, making them indistinguishable to unsuspecting users. For instance, a user intending to visit a well-known website may inadvertently type a typo in the URL or click on a link with a subtly altered domain name, leading them to a malicious site instead. Once users land on these counterfeit websites, they may fall victim to various cyber threats, including phishing attacks, malware downloads, and financial scams.

Other SEO Poisoning Methods

SEO poisoning methods allow cybercriminals to manipulate search engine results and increase the visibility of their malicious websites.

Here are some common techniques they use:

1. Keyword Stuffing: Cybercriminals stuff their websites with popular search terms and keywords related to trending topics or commonly searched topics. This increases the likelihood of their site appearing at the top of search results for those keywords.
2. Content Spamming: They create numerous pages filled with irrelevant or low-quality content but optimized with popular keywords. These pages are designed to attract search engine traffic but offer little to no value to users.
3. Link Farming: Cybercriminals create networks of websites or web pages that link to each other and to their main malicious site. This manipulates search engine algorithms into thinking the site is popular and reputable, leading to higher rankings in search results.
4. Typosquatting: Also known as URL hijacking, this method involves registering domain names that are slight misspellings or variations of popular websites. When users make typing errors in the URL, they may be directed to the malicious site instead of the intended destination. This is especially common around banking website domains.
5. Top Level Domains: This is a common approach when impersonating government agencies. For example, instead of FBI.gov, the criminals register FBI.com  Normally government agencies are careful about this, but new agencies or campaigns may leave many opportunities for the criminals.
6. Doorway Pages: These are low-quality web pages optimized for specific keywords and designed to redirect visitors to the cybercriminal’s main site. They are often hidden from users but accessible to search engine crawlers, tricking search engines into ranking the site higher.
7. Hacked Websites: Cybercriminals may exploit vulnerabilities in legitimate websites to inject malicious code or links. When users search for related keywords, these compromised sites may appear in search results and lead users to malware-infected pages.
8. Black Hat SEO Techniques: This includes various unethical tactics such as cloaking (presenting different content to search engines and users), hidden text (using text colors similar to the background to hide keywords), and link spamming (creating artificial backlinks to manipulate search rankings).

These methods aim to deceive search engines and users into believing that the malicious sites are legitimate and relevant to their search queries. By exploiting weaknesses in search engine algorithms and user behavior, cybercriminals can increase the visibility of their malicious content and target unsuspecting users for scams, malware infections, and other malicious activities.

In light of the pervasive threat posed by SEO poisoning, users must exercise constant vigilance and skepticism when browsing the internet.

SCARS Recommends These Precautions

1. Use an Anti-Malware plugin in your browser. SCARS uses Malwarebytes, but there are several good ones. These help block malicious websites from opening in your browser
2. Quad 9 is a DNS defense tool that prevents access to reported malicious domains.
3. Double-checking URLs before clicking on links and verifying the authenticity of websites, can help mitigate the risk of falling victim to malicious schemes.
4. Never type in a URL / web address from memory. Bookmark (save) the addresses you use frequently in your browser, or search Google for the official websites of banks, financial institutions, and government