Gaming Google News: Once as Spam, Once as…?

[Update: it looks like many others have been observing the same issue. Updated What is Happening section with detail.]

It is not just fake election results sites that are gaming Google’s News. As of writing almost 50% of the news stories that display on Google Health are fake news articles that redirect to spam sites.

This morning while reading Google news and putting off checking my inbox I clicked on the Health category. I skimmed a stories about obesity, seductively named veggies, and a legionnaires outbreak at a two LA fitness clubs. Then things got a bit stranger.

The first strange article seemed like a mistake in how the title was selected.

Then I read the text. No, this was not right at all. The page looked like it was part of a Search Engine Optimization (SEO) strategy. Flukes in algorithmically generated news do happen. Then I scanned further and found more. Much more.

Nine out of 19 news stories (47%) on Google News Health are a variant of the spam at time of writing.

Google News health was yielding up a ton of obviously SEO pages advertising the usual Viagra and Cialis. But also online dating services. Taking a look at Viagra jelly we see that this is generating enough of a buzz that the algorithm is offering “realtime coverage” of the event. Clearly, breaking news.

 

Helpfully I’ve got some other related stories, including Herbal Viagra.

Google News Spam Redirects

Readers will notice that there are at least two involved sites: “The Missouri Times” and the “Microfinance Monitor.” The Missouri Times is a news site with an online presence. Microfinance Monitor also appears to be a preexisting site.

Clicking on a link in Google Health gets you…penis pills

The links, as displayed on Google appear like this:

http://www.microfinancemonitor[.]com/?1goly=1733302786

Directly visiting the links (without clicking via Google News) leads the user to the original site. However, clicking via Google News leads to the chain of redirects.

http://www.microfinancemonitor[.]com/?1goly=1733302786
to
shop.medcom[.]top/search.html?key=viagra%20caps#fb
to
topcanadadrugs24rx[.]com/find/viagra%20caps?ida=3027

The result is an online pharmacy.

An online pharmacy site is the ultimate destination of the chain of redirects.

At the time of writing, on the “news” stories redirects to spam websites like “Dirty Tinder” and “Top Canadian Pharmacy.” There are no news stories.

What is Happening

It appears that news sites deemed legitimate by Google News are being modified by third parties. These sites are then exploited to redirect to the spam content. It appears that the compromised sites are examining the referrer and redirecting visitors coming from Google News to shop.medcom[.]top (and possibly other sites.

Update:  A story from The Register lays out how this works.

 

The Reg shows how visitors coming from Google News are redirected on a different, compromised site.

A quick investigation using Passive Total suggests that the operation is larger, and the iframe with a redirect to “shop.medcom[.]top” may be present in a range of news sites.

Some other news sites showing evidence of the iframe

Why Spam on Google News is a Bigger Issue

The use of real news sites provides a clever vector for the insertion of more problematic fake news and disinformation into a prominent landing page for news.

Just as fake news can damage democracy, fake news about health can have public health consequences. The fact that such obvious fakes have bubbled into Google News makes it clear that the information served there is still susceptible to intentional manipulation.

In this case it is hard to believe that anyone reading the headlines on articles would mistake them for real medical advice. The implausible headlines show a lack of imagination from whomever is behind them. They could have used much more plausible headlines, and easily redirected to lookalike news pages for the purposes of disinformation.  The case shows how easy might be for someone with other, less transparent objectives, to manipulate what readers see.