Just Dork and Crawl: Measuring Illegal Online Gambling Defacement in Indonesian Websites

• URL: http://arxiv.org/abs/2508.19368v1
• Date: Tue, 26 Aug 2025 19:01:12 GMT
• Title: Just Dork and Crawl: Measuring Illegal Online Gambling Defacement in Indonesian Websites
• Abstract summary: This study investigates the defacement of Indonesian websites by actors promoting illegal online gambling.<n>Using a lightweight methodology that combines keyword-driven dorking with systematic crawling, we identified 453 defaced webpages within one month.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: This study investigates the defacement of Indonesian websites by actors promoting illegal online gambling. Using a lightweight methodology that combines keyword-driven dorking with systematic crawling, we identified 453 defaced webpages within one month. Although dorking alone yielded a false positive rate of approximately 20.3\%, the integration of crawling and keyword-counting enabled reliable differentiation between true and false positives. Our measurements revealed diverse defacement behaviors, including repeat defacements (150 cases), fixed instances (129), keyword modifications (55), and redirections or hidden URL injections. In total, 8,837 unique third-party URLs spanning 5,930 domains were captured, with a small subset recurring across multiple sites. Website responses were inconsistent, with an average reaction time of 75.3 hours. These findings demonstrate that simple, reproducible techniques can provide meaningful insights into the scale, persistence, and dynamics of defacement, highlighting the importance of continuous measurement for strengthening defenses against online gambling activities.

Related papers

• RiskChainBench: A Benchmark for Obfuscated Platform Message Restoration and Evidence-Grounded Web Investigation [32.78931752588511]
  We introduce RiskChainBench, pairing 3,600 synthetic token-text restoration inputs from 600 source sessions with 600 corresponding human-labeled local web environments.<n>A model first restores the message, operational intent, and destination; the same underlying model then acts as a VLM-driven web agent.<n>We score restoration and correct-routing web investigation separately and compose them offline by applying the frozen primary-entry prediction as a gate to the same Task 2 result.
  arXiv  Detail & Related papers  (2026-09-15T09:32:45Z)
• Detecting and Correcting Reference Hallucinations in Commercial LLMs and Deep Research Agents [38.68399248551709]
  Large language models and deep research agents supply citation URLs to support their claims.<n>We address six research questions about citation URL validity using 10 models and agents on DRBench and 3 models on ExpertQA.<n>We find that 3--13% of citation URLs are hallucinated, while 5--18% are non-resolving overall.<n>We release URLhealth, an open-source tool for URL liveness checking and stale-vs-hallucinated classification using the Wayback Machine.
  arXiv  Detail & Related papers  (2026-04-03T16:49:02Z)
• Shy Guys: A Light-Weight Approach to Detecting Robots on Websites [1.5036109852211983]
  This paper proposes a lightweight, passive approach to bot detection, operating entirely on standard web server logs with no client-side interaction.<n>We evaluate the method on over 4.6 million requests containing 54,945 unique user-agent strings collected from website hosted all around the earth.<n>Our approach detects 67.7% of bot traffic while maintaining a false-positive rate of 3%, outperforming state of the art (less than 20%)
  arXiv  Detail & Related papers  (2026-03-30T15:07:00Z)
• Characterizing Phishing Pages by JavaScript Capabilities [77.64740286751834]
  This paper aims to aid researchers and analysts by automatically differentiating groups of phishing pages based on the underlying kit.<n>For kit detection, our system has an accuracy of 97% on a ground-truth dataset of 548 kit families deployed across 4,562 phishing URLs.<n>We find that UI interactivity and basic fingerprinting are universal techniques, present in 90% and 80% of the clusters.
  arXiv  Detail & Related papers  (2025-09-16T15:39:23Z)
• Network-Level Prompt and Trait Leakage in Local Research Agents [19.89535252097747]
  We show that Web and Research Agents (WRAs) are vulnerable to inference attacks by passive network adversaries such as ISPs.<n>WRAs could be deployed locally by organizations and individuals for privacy, legal, or financial purposes.
  arXiv  Detail & Related papers  (2025-08-27T21:24:10Z)
• WebGuard: Building a Generalizable Guardrail for Web Agents [59.31116061613742]
  WebGuard is the first dataset designed to support the assessment of web agent action risks.<n>It contains 4,939 human-annotated actions from 193 websites across 22 diverse domains.
  arXiv  Detail & Related papers  (2025-07-18T18:06:27Z)
• Registration, Detection, and Deregistration: Analyzing DNS Abuse for Phishing Attacks [2.160481692907504]
  Phishing continues to pose a significant cybersecurity threat.<n>It is essential to address this fundamental challenge at the root, particularly in phishing domains.<n> Domain registration presents a crucial intervention point, as domains serve as the primary gateway between users and websites.
  arXiv  Detail & Related papers  (2025-02-13T18:02:48Z)
• Illusions of Relevance: Using Content Injection Attacks to Deceive Retrievers, Rerankers, and LLM Judges [52.96987928118327]
  We find that embedding models for retrieval, rerankers, and large language model (LLM) relevance judges are vulnerable to content injection attacks.<n>We identify two primary threats: (1) inserting unrelated or harmful content within passages that still appear deceptively "relevant", and (2) inserting entire queries or key query terms into passages to boost their perceived relevance.<n>Our study systematically examines the factors that influence an attack's success, such as the placement of injected content and the balance between relevant and non-relevant material.
  arXiv  Detail & Related papers  (2025-01-30T18:02:15Z)
• Beyond time delays: How web scraping distorts measures of online news consumption [0.4706932040794696]
  We investigate discrepancies between content obtained directly during user interaction with a website (in-situ) and content scraped using the URLs of participants' logged visits (ex-situ) with various time delays.<n>We find substantial disparities between the methodologies, uncovering that errors are not uniformly distributed across news categories.<n>Our research emphasizes the need for data collection methods that capture web content directly in the user's environment.
  arXiv  Detail & Related papers  (2024-11-30T13:36:48Z)
• Poisoning Retrieval Corpora by Injecting Adversarial Passages [79.14287273842878]
  We propose a novel attack for dense retrieval systems in which a malicious user generates a small number of adversarial passages. When these adversarial passages are inserted into a large retrieval corpus, we show that this attack is highly effective in fooling these systems. We also benchmark and compare a range of state-of-the-art dense retrievers, both unsupervised and supervised.
  arXiv  Detail & Related papers  (2023-10-29T21:13:31Z)
• Poisoning Web-Scale Training Datasets is Practical [73.34964403079775]
  We introduce two new dataset poisoning attacks that intentionally introduce malicious examples to a model's performance. First attack, split-view poisoning, exploits the mutable nature of internet content to ensure a dataset annotator's initial view of the dataset differs from the view downloaded by subsequent clients. Second attack, frontrunning poisoning, targets web-scale datasets that periodically snapshot crowd-sourced content.
  arXiv  Detail & Related papers  (2023-02-20T18:30:54Z)
• Countering Malicious Content Moderation Evasion in Online Social Networks: Simulation and Detection of Word Camouflage [64.78260098263489]
  Twisting and camouflaging keywords are among the most used techniques to evade platform content moderation systems. This article contributes significantly to countering malicious information by developing multilingual tools to simulate and detect new methods of evasion of content.
  arXiv  Detail & Related papers  (2022-12-27T16:08:49Z)
• Characterizing Malicious URL Campaigns [16.807162826069185]
  URLs are central to a myriad of cyber-security threats, from phishing to the distribution of malware. Their inherent ease of use and familiarity is continuously abused by attackers to evade defences and deceive end-users. We refer to such behaviours as campaigns, with the hypothesis being that attacks are often coordinated to maximize success rates and develop evasion tactics.
  arXiv  Detail & Related papers  (2021-08-29T01:00:44Z)
• Keystroke Biometrics in Response to Fake News Propagation in a Global Pandemic [77.79066811371978]
  This work proposes and analyzes the use of keystroke biometrics for content de-anonymization. Fake news have become a powerful tool to manipulate public opinion, especially during major events.
  arXiv  Detail & Related papers  (2020-05-15T17:56:11Z)
• Phishing URL Detection Through Top-level Domain Analysis: A Descriptive Approach [3.494620587853103]
  This study aims to develop a machine-learning model to detect fraudulent URLs which can be used within the Splunk platform. Inspired from similar approaches in the literature, we trained the SVM and Random Forests algorithms using malicious and benign datasets. We evaluated the algorithms' performance with precision and recall, reaching up to 85% precision and 87% recall in the case of Random Forests.
  arXiv  Detail & Related papers  (2020-05-13T21:41:29Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.