Siphoning traffic from SERPS to track for what?

Posted by joy

So, the other night I was searching on Google and let’s just say that I could have been searching for dentists in Champaign, Illinois. And since I misspelled the state, I got some very, very curious SERPS such as the ones below.

Live Google Search and an image of the Google SERP I saw.

Being curious about the results from the .info domains, I went ahead and clicked on one and there was a page that sorta kinda looked like a Google results page without the Google logo.

Even better, I took a minute and scrolled down to the bottom of this particular .info page which had apparently mirrored Google results page for “Champaign Illinois dentist”. It was this mirroring which made the bogus .info pages appear high in Google searches.


Taking a closer look at the html for this .info page, I found a number of curious things.

1) The top of the .info page is dominated by an iframe which pulls a query from a site called cleansearch.info.

2) Take a look at the bottom of the .info page. All of the links on the bottom of the page which vaguely mirrors a legit Google results page, despite anchor text, were going to pages with a .info TLD. These .info pages look to be related to one another and have that cleansearch iframe at the top.

3)All of the links are being tracked for clicks. (See this Webmaster World thread for which explains how onmousedown=”returnclk()” works.)

4)If you look at the source of the .info results page, you’ll see that there are many, many more of these .info domains out there.

5)Do I need to mention that the WHOIS information for any of the .info domains listed is bogus? (1fk489 WHOIS) And these domains, including (cleansearch WHOIS), have been recently registered this past month?

6)Do I need to mention that the hosting company for cleansearch is isprime, which has a “healthy” reputation on news.admin.net-abuse.sightings (Warning: Some NSFW messages)?

The questions remain, just who is cleansearch.info? Why are they trying to rank highly in SERPS with bogus results to siphon off and track traffic from Google? And just what are they going to do with their knowledge?

[tags]SERPS, Google, search engines, traffic, WebmasterWorld[/tags]


2 Responses to “Siphoning traffic from SERPS to track for what?”

  1. plow Says:

    I’ve been getting directed to these mirrored sites by Google News Alerts. A surprising result. I’ve seen it over the last several weeks. I too found it curious that there is no obvious revenue model for these folks.

    Any further info/developments on this would be appreciated. At minimum, I’m tiring of the game, clicking on bogus news alerts. As an SEO guy, I’m interested to know how if I can legitimately get my news distributed by Google Alerts in this fashion.

    Here’s an example Google News Alert from Google Alerts [googlealerts-noreply@google.com]

    Headline: Freedom financial mortgage (a hypertextlink to http://4599.3wrwtsw.info/, your infamous cleansearch.info.)
    Text: Interviewed by NewRetirement.com, Jim Mahoney, CEO Financial Freedom Senior …
    non-livehttp://www.newretirement.com/Services/Financial_Freedom_CEO_Interview.aspx …
    ________________________________________
    This as-it-happens Google Alert is brought to you by Google.
    Remove this alert.
    Create another alert.
    Manage your alerts.

  2. Didier Stevens Says:

    I’ve also experienced a similar search result looking for a heating technician. I landed on a Drive-by Download page. I’ve blogged about it, and I host a movie showing the drive-by download in action.

    Didier

Leave a Reply