Search ranger system and double-funnel model for search spam analyses and browser protection

A method comprising:

• determining at least one spammer targeted keyword relating to a common keyword used in commerce search queries, the determining being based in part on a popularity of the at least one spammer targeted keyword amongst advertisers, wherein the popularity of the at least one spammer targeted keyword amongst the advertisers is based in part on a number of bids provided by the advertisers, and wherein the at least one spammer targeted keyword is associated with a syndication business, the syndication business including at least a publisher, an advertiser, and a syndicator;
• inputting the at least one spammer targeted keyword to a search engine to generate search results including a plurality of uniform resource locators (URLs);
• accessing, by one or more processors, one or more URLs of the plurality of URLs;
• recording the one or more URLs, wherein the recording comprises redirection tracking that intercepts redirection traffic;
• grouping the one or more recorded URLs using similarity-based grouping;
• verifying that at least one of the one or more URLs comprises a spam URL;
• and
• determining that the spam URL is associated with a spam syndication program, the spam syndication program including at least a spam publisher associated with a doorway page for redirecting a browser to a redirection domain associated with the spam publisher.

A method comprising:

• identifying one or more spammer targeted keywords related to keywords used in search queries, the identifying being based in part on a popularity of the one or more spammer targeted keywords amongst advertisers, wherein the popularity of the one or more spammer targeted keywords amongst the advertisers is based in part on a number of bids provided by the advertisers, and wherein the one or more spammer targeted keywords is associated with a syndication business, the syndication business including at least a publisher, an advertiser, and a syndicator;
• implementing a search based in part on the one or more spammer targeted keywords;
• accessing, by one or more processors, individual uniform resource locators (URLs) of a set of URLs that comprise a search result to the search;
• recording one or more redirection URLs associated with the set of URLs based in part on the accessing;
• determining that the one or more redirection URLs redirect to a known spammer domain, the one or more redirection URLs including one or more associated URL domains;
• classifying, based in part on the recording and the determining, one or more URLs of the set of URLs as one or more classified spam URLs;
• updating a list of known spam domains to include the one or more associated URL domains;
• and
• determining that the one or more associated URL domains are associated with a spam syndication program, the spam syndication program including at least a spam publisher associated with a doorway page for redirecting a browser to a redirection domain associated with the spam publisher.