Abstract: Web sites are crawled using multiple browser profiles to avoid malicious cloaking. Based on web page content returned from HTTP requests using the multiple browser profiles, web sites returning substantively different content to HTTP requests for different browser profiles are identified. Web sites are further filtered by common cloaking behavior, and redirect scripts are extracted from web page content that performed cloaking. Signatures comprising tokenized versions of the redirect scripts are generated and compared to a database of known cloaking signatures. URLs corresponding to signatures having approximate matches with signatures in the database are flagged for recrawling. Recrawled URLs are verified for malicious cloaking again using HTTP requests from multiple browser profiles.

Abstract: The technology presented herein enables malicious websites to be discovered based on web analytics identifiers associated therewith. In a particular embodiment, a method provides obtaining information about one or more first websites that are known to be malicious. The method further provides identifying one or more first analytics identifiers that are each associated with at least one of the first websites and identifying one or more second websites that are each associated with at least one of the first analytics identifiers.

Abstract: The technology presented herein enables malicious websites to be discovered based on web analytics identifiers associated therewith. In a particular embodiment, a method provides obtaining information about one or more first websites that are known to be malicious. The method further provides identifying one or more first analytics identifiers that are each associated with at least one of the first websites and identifying one or more second websites that are each associated with at least one of the first analytics identifiers.