Second of 2 parts

MANILA, Philippines – In Part 1, we explained how we tracked down the identity of a black hat SEO marketer whose network of websites has been spamming the websites of Rappler, ABS-CBN News, and Philstar.  

Working with Swedish digital forensic group Qurium Media, we traced the identity of the black hat through the historical domain registration records of one of the websites that was rated by an SEO monitoring tool as highly toxic, or likely part of link-building schemes. 

Must Read

Dubious sites spamming PH news groups traced to Swedish black hat SEO operator

The website, whose domain name was registered by a Swedish individual, Richard Genmar, shared the same hosting server (IP address 78.69.18.135) with over 500 other websites. Most of these sites shared this same title: “The Globe – The world’s most visited web pages.” Hundreds of sites from this same IP address were found in the data on backlinks to the Philippine news groups mentioned. 

While websites hosted by this IP address are uncomplicated in terms of functionality and appear to be all dated in look, there is no doubt that it took some effort and resources to put the entire infrastructure up, much less maintain it.  

The potential payoffs, however, are significant. Assuming that targets pay, the windfall could range from the tens of thousands to millions of dollars.

The Philippine news sites were not the only ones that The Globe had targeted. In one submission to Google’s Search Console Help website, one webmaster also reported encountering spam link issues from theglobe.net.

According to the webmaster who reported the issue, they had contacted The Globe many times, asking them to remove the backlinks but received only an automated response. “We also offered them to pay to remove the URLs and they don’t reply, my assumption is that a competitor has paid to have these links added and now not able to have them removed.”

We sought the side of Genmar and The Globe by emailing through their published email addresses. We also asked if they would be willing to remove at no cost the unwanted backlinks to the websites of Rappler and the other Philippine news websites. We have yet to receive a response to our questions and will update this story once we do.

A black hat marketer’s infrastructure

To maintain a domain, payment of an annual fee must be made to domain registries like GoDaddy and others, which can range from $US2 (P114.34)* to $20 (P1,143.46) up to thousands of dollars per domain, depending on demand for keywords used in the preferred domain. 

Opting for cheaper domains would still cost from $1,000 (P57,172) to $10,000 (P571,828) a year to maintain 500 domains. This excludes the cost of hosting the site, which could be a lot more. 

The Globe has not confined its operations to its self-hosted websites. While it is not possible to connect The Globe to most of the blogs on Blogspot and Firebase which have been spamming Rappler, there are indicators that it has also been abusing these services to amplify its websites. For example, the blogspot website below backlinks to add-link.us, one of the over 500 sites hosted on IP address 78.69.18.135.

Why us?

Why would a Swedish black hat operator who can arguably go after more lucrative targets choose to waste time and resources creating tens of thousands of backlinks to Philippine news websites? Did the people behind The Globe take it upon themselves to target these news sites or did others pay them for performing this service?

Must Read

Black hat SEO operators sabotage PH news sites with toxic backlinks

As of last check, the search monitoring tool has already flagged 1,439 unwanted backlinks to Rappler from this specific cluster of sites. If all of these were paid, then it looks like somebody shelled out $4,317 (P246,817) to spam Rappler alone. On top of that, an additional 1,256 backlinks to Philstar would have cost $3,768 (P215,435). Yet another 867 backlinks to ABS-CBN would have cost $2,901 (P165,852). 

If adding backlinks is costly, having unwanted backlinks deleted from websites operated by “The Globe” is even more expensive. The Globe also charges $36 to get unwelcome backlinks from its toxic sites deleted. 

At this rate, the three Philippines news websites will have to pay tens of thousands of dollars each to get The Globe to remove backlinks from the cluster of sites which share the title: “The Globe – The world’s most visited web pages.” 

In the case of Rappler, the bill could be an astounding $51,804 (P2,961,677) for 1,439 backlinks. For Philstar, it’s $45,216 (P2,585,139) for 1,256 backlinks. Finally, for ABS-CBN News, it would be $31,212 (P1,784,487) for 867 unwanted backlinks. 

We’re not yet even talking here of backlinks from the other dubious sites, some of which are linked to this Swedish black hat network. 

At those prices, if all of the backlinks targeting the three Philippine news websites are taken into consideration, black hat operators could be holding the traffic of the news websites hostage for a price tag that could range from hundreds of thousands to over a million dollars. 

For an industry already struggling from loss of advertising revenue to the internet giants, it is a preposterous sum. 

Payouts for the websites of The Globe are made through Paypal to an entity called The Globe Enterprises. Data reflected on the website of the Bolagsverket, the Swedish Companies Registration Office, indicates that this company is based in Stockholm County, Sweden. 

Data published on the information portal Justia.com indicate that the trademark was meant to be used for the following goods and services – “website search engine services, namely, providing search engines for the Internet.”

Clearly, the Globe’s services have nothing to do with “providing search engines for the Internet.”

Going after black hat marketers

After finding a black hat backlink spammer, what’s next?

Unfortunately, identifying who launched a backlink spamming operation is one thing. Holding these actors accountable for the aggravation and the trouble is another. 

Because search optimization is a field that few people understand, there are practically no penalties for bad actors and their manipulative schemes. 

A website owner can always report these operators to Google, the world’s dominant search engine, but Google itself is very secretive about how it treats reports in relation to manipulative links. 

Must Read

Negative SEO: How black hat marketers abuse Google’s rules vs toxic backlinks

The only advice that Google gives to website owners in relation to spammy backlinks is that they should either remove those themselves or report them through their disavow tool.

The first advice, however, assumes that the website owner is complicit in the manipulative link-building scheme.

As discussed in our previous stories, backlinks are generally desirable. Black hat SEO marketers however, have been gaming the process through manipulative link-building schemes. This has triggered an arms race between Google and other search engines and these black hats. Google’s engineers, in effect, had to constantly think of indicators that might identify possible manipulative schemes.

In such a battlefield, victims of negative SEO attacks like Rappler and the other Philippine news sites, become collateral damage.

Google’s guidelines for webmasters explain as much: “In some circumstances, incoming links can affect Google’s opinion of a page or site. For example, you or an SEO that you’ve hired may have built bad links to your site via paid links or other link schemes that violate our quality guidelines. First and foremost, we recommend that you remove as many spammy or low-quality links from the web as possible.”

This is clearly not possible with respect to the toxic backlinks to the Philippine news sites.

Genmar and The Globe have yet to respond to our email asking if they would consider taking down the unwanted backlinks at no cost to the news organizations.

The only way website owners can signal to Google that they are not complicit is through the disavow process. In effect, website owners need to tell Google that they are disowning the bad backlinks.

This process involves submitting a list of backlinks or domains for disavowal via the Google Search Console, which is typically accessible to website administrators. By “disavowing” these backlinks, the webmaster is telling Google that it is disowning the backlinks listed and the search algorithm should therefore ignore them.

Rappler has been going through this process since it discovered the spammy backlinks.

Google, however, reminds webmasters to use disavowal with caution because legitimate backlinks could be disowned in the process. To avoid this requires digging into massive amounts of backlink data, and undoing the effects of a negative SEO attack could take months.

Laws against spam are usually related to email and do not cover backlink spam. 

Spamming is not even illegal in the Philippines. In the 2014 case of Disini, Jr. vs. Secretary of Justice with respect to the Cybercrime Prevention Act of 2012, the Philippine Supreme Court said that unsolicited commercial communications or spams are “legitimate forms of expression.” The National Privacy Commission cited this in its October 2020 response to a letter writer who asked for an advisory opinion on this issue.   

The nearest thing that could be cited is a provision in the e-commerce law on “interference” in a computer system or information and communication systems, according to information and technology law expert JJ Disini. 

In the absence of any clear penalties, the murky waters of the World Wide Web will remain a playground for black hat operators. – with Bingbong Recto and Ogoy San Juan/Rappler.com and Tord Lundström, Qurium Media

*Conversion rate: $1 = P57.18