As mobile devices have become the primary tool for internet access, mobile users have increasingly become the main target for the dissemination of illicit content. To promote illicit content to mobile users, attackers employ a technique known as mobile cloaking. This technique displays the illicit content exclusively to mobile users while showing regular content to crawlers and desktop users. In this study, we propose a scalable detection framework to identify mobile cloaking pages in real-world web environments. We retrieved over 2.5 million search results for illicit keywords from three major search engines as detection targets. We then simulated both desktop and mobile user access to these pages, collecting data and manually annotating a labeled dataset containing 26,790 samples. By comparing differences between desktop and mobile pages in terms of text, visuals, network, elements, and URLs, we extracted 19 classification features and trained and evaluated an XGBoost classifier. The model achieved an accuracy of 0.998 and an F1 score of 0.997 on the labeled dataset. Using the trained classifier, we detected 95,588 cloaked pages in the full dataset. Based on this, we conducted a detailed analysis of the scale, promotional strategies, techniques, and targets of mobile cloaking. Additionally, we found that existing URL safety detection tools are ineffective at identifying mobile cloaking. These findings underscore the extensive impact and prevalence of mobile cloaking and highlight the urgency for the security community to prioritize and address these risks.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Wolf in Sheep’s Clothing: Understanding and Detecting Mobile Cloaking in Blackhat SEO

  • Yan Li,
  • Zhenrui Zhang,
  • Zhiyu Lang,
  • Xiang Li,
  • Jia Zhang,
  • Donghong Sun

摘要

As mobile devices have become the primary tool for internet access, mobile users have increasingly become the main target for the dissemination of illicit content. To promote illicit content to mobile users, attackers employ a technique known as mobile cloaking. This technique displays the illicit content exclusively to mobile users while showing regular content to crawlers and desktop users. In this study, we propose a scalable detection framework to identify mobile cloaking pages in real-world web environments. We retrieved over 2.5 million search results for illicit keywords from three major search engines as detection targets. We then simulated both desktop and mobile user access to these pages, collecting data and manually annotating a labeled dataset containing 26,790 samples. By comparing differences between desktop and mobile pages in terms of text, visuals, network, elements, and URLs, we extracted 19 classification features and trained and evaluated an XGBoost classifier. The model achieved an accuracy of 0.998 and an F1 score of 0.997 on the labeled dataset. Using the trained classifier, we detected 95,588 cloaked pages in the full dataset. Based on this, we conducted a detailed analysis of the scale, promotional strategies, techniques, and targets of mobile cloaking. Additionally, we found that existing URL safety detection tools are ineffective at identifying mobile cloaking. These findings underscore the extensive impact and prevalence of mobile cloaking and highlight the urgency for the security community to prioritize and address these risks.