The author is involved in the life of a web site since some years. Among other features, this site is maintaining statistics about its activity. This current 01/02/2005, around noon, we have discover that the string "inces+incest+ncest" has appeared among the query strings reported by the Webalizer. To examine what happens in the rest of the world, we have launched a Google query with this string (alg:Loading) .
It appears that among the 100 answers, 97 were revealing the name of an ordinary web site. In fact, the quoted pages are related with web servers usage and 90 of them were standard Webalizer pages, with a title beginning by "Usage Statistics for". To summarize : a lot of ordinary web sites are tagged as pornographic, and are quoted in response to pornographic queries.
The aim of this paper is to examine how it could happen that so many ordinary web site are tagged as pornographic, and what counter-measures can be used by the web sites under this attack. Our main result is that two different attacks are currently active. We called them respectively the "sex+drug" attack and the "inces+ncest" attack.
Concerning the "sex+drug" attack, it seems clear that the intent of the attackers is to increase the ranking of their own site with Google and other search engines, by generating more links to it. sec:Enquiry describes the enquiry we have launched the 01/02/2005 to collect evidences about what happens in the web sites across the world. sec:January describes the results obtained by comparing 292 infested January Usage pages, and sec:February describes the results obtained two weeks later by comparing 864 infested February Usage pages.
Some counter-measures are described in 5.
Concerning the "inces+ncest" attack, the intent is less clear. When available, results will be given in sec:Search.
