Search ranger system and double-funnel model for search spam analyses and browser protection

1. A method comprising:

providing a multi-layer model that comprises:

an advertiser layer associated with advertisers that compensate syndicators to display advertisements;

a syndicator layer associated with the syndicators that buy click traffic from aggregators for the advertisements;

an aggregation layer associated with the aggregators that buy the click traffic from spammers to insulate the syndicators and the advertisers from being associated with spam content;

a redirection layer associated with redirection domains used by the spammers to fetch the spam content after a doorway web page is clicked; and

a doorway layer associated with doorway web pages that the spammers promote to top search result positions to attract the click traffic;

identifying, based on an analysis of the multi-layer model, the aggregation layer as a bottleneck layer that uses at least one Internet Protocol (IP) block to funnel the advertisements and to associate the advertisements with the spam content; and

performing, by one or more processors configured with executable instructions, one or more corrective actions that act on the bottleneck layer to protect web browsers from search spam.

2. The method of claim 1 , wherein the one or more corrective actions act on information associated with the bottleneck layer.

3. The method of claim 1 , wherein the one or more corrective actions act on a block of IP addresses.

4. The method of claim 1 , wherein the multi-layer model models redirection spam.

5. The method of claim 1 , wherein the identifying the aggregation layer comprises using search keywords.

6. The method of claim 5 , wherein the search keywords comprise commercial keywords.

7. The method of claim 5 , wherein the search keywords comprise a set that targets the spammers.

8. The method of claim 5 , wherein the search keywords comprise a set that targets the advertisers.

9. The method of claim 1 , wherein the one or more corrective actions act on a search engine to protect web browsers from the search spam.

10. The method of claim 9 , wherein the one or more corrective actions act on a ranking algorithm of the search engine.

11. The method of claim 1 , wherein the one or more corrective actions comprise locating a spam doorway page.

12. A method comprising:

providing a multi-layer spam model that includes:

an advertiser layer associated with an advertising entity that compensates a syndicator to display one or more advertisements;

a syndicator layer associated with the syndicator that buys click-through traffic from an aggregator for the one or more advertisements;

an aggregation layer associated with the aggregator that buys the click-through traffic from one or more spammers to insulate the syndicator and the advertising entity from being associated with spam content;

a redirection layer associated with one or more redirection domains used by the one or more spammers to fetch the spam content after a doorway web page is clicked; and

a doorway layer associated with the doorway web page that the one or more spammers promote to top search result positions to attract the click-through traffic;

identifying at least one of the syndicator layer, the aggregation layer or the redirection layer as an intermediate layer in the multi-layer spam model that is used to convert the click-through traffic associated with the spam content into money;

identifying a block of Internet Protocol (IP) addresses in the intermediate layer that funnels the one or more advertisements from the advertiser layer to the doorway web page from the doorway layer; and

performing, by one or more processors configured with executable instructions, one or more corrective actions on the block of IP addresses.

13. The method of claim 12 , wherein the one or more corrective actions protect web browsers from search spam.

14. The method of claim 13 , wherein the one or more corrective actions act on a search engine to protect the web browsers from the search spam.

15. The method of claim 14 , wherein the one or more corrective actions act on a search result ranking algorithm of the search engine.

16. The method of claim 12 , further comprising comparing an IP address in the block of IP addresses to a previously identified IP address.

17. The method of claim 12 , further comprising periodically repeating the method to monitor spam.

18. One or more computer memories storing instructions that, when executed by a computing device, instruct the computing device to perform actions comprising:

providing a multi-layer model including:

an advertiser layer associated with an advertising entity that compensates a syndicator to display one or more advertisements;

a syndicator layer associated with the syndicator that buys click-through traffic from an aggregator for the one or more advertisements;

an aggregation layer associated with the aggregator that buys the click-through traffic from one or more spammers to insulate the syndicator and the advertising entity from being associated with spam content;

a redirection layer associated with one or more redirection domains used by the one or more spammers to fetch the spam content after a doorway web page is clicked; and

a doorway layer associated with the doorway web page that the one or more spammers promote to top search result positions to attract the click-through traffic;

identifying at least one of the syndicator layer, the aggregation layer or the redirection layer as an intermediate layer in the multi-layer model that is used to convert the click-through traffic associated with the doorway web page into value;

identifying at least one Internet Protocol (IP) block associated with the intermediate layer, the at least one IP block configured to funnel the one or more advertisements as advertising spam to the click-through traffic associated with the doorway web page; and

taking one or more corrective actions on the at least one IP block to protect web browsers from the advertising spam.