Cracking The Code On Amazon Fake Reviews Part 3

 

Astroturf and Spam Infographic.jpg

In our previous instalment we covered the age and gender demographics of Amazon reviewers in this instalment we will delve deep into the practice of link building and international ISP as well as how astroturf and spam operations operate and their virtual and literal links to Amazon reviews.

 

Lets start with our first example

we chose the review below.

AS5_review spam examnple_1

We performed an exact search based on the first line of the review.

search_result_for AS5_amazon_Review_-2

These results can change week to week  whereas, one week it can render a link to a different site as these links are continuously under link building optimization.

We followed the first link which was malware site.

80obola_AS5_followed_link_3

Brave souls that we are, we ignored the warning and we found what was an obvious Arctic Silver Amazon affiliate astroturf and spam site.

80obola_AS5_follo4

Following the next link after a sneaky redirect we were taken to the site bellow with no mention of Arctic Silver in the site at all .

2nd_Link_glasspack_5

We performed an ICANN WHOIS search for 80bola and our returns found the website registered in Panama.

Hold on because this is where it starts to get interesting.

We then further conducted a search

80bola_whois_6

We subsequently made two discoveries.

  1. Returned search engine results implicitly showed 340,000 returns on an exact search
  2. We found there to be 497 domain names all registered to the same P.O. box in Panama

We then performed another ICANN WHOIS search this time for glasspack.com.ar

A very interesting discovery, was that on a number of domain registry sites over a period of a month and could not find any registration for that domain name.

Which begs to ask the following questions:

  1. could it be that the code was was inserted directly into the search engine ?
  2. in other words was the search engine itself hacked?

 

whois_glasspack.com.ar_null_result_perhaps_hacked_search_engine_or_Just_registered_same result after_2_weeks_8

Of note:

All this link building and spamming is really a massive effort to gain dominance on page one search results.

In other words, an astroturf technique to ensure their page one top three ranking of search engine results.

In closing , this will now take us to our next phase of the investigation and part four of our series where we will show you some techniques used by spam and astroturf operators to optimize their search and review results.

Updated 08/26/2015

 

 

Leave a comment