November 2020 Monthly Spam Reporting

MONTHLY SPAM DOCUMENTS
REPORTING
NOVEMBER 2020
TABLE OF CONTENTS
HEADINGS
UPDATES 1
MONTHLY DOCUMENTS IN NUMBERS 2
FREQUENTLY IDENTIFIED SPAM DOCUMENTS 3
SECURITY THREAT 14
SPAM REPOSITORY 21
APPENDICES
SPAM CLASSIFICATION 27
SPAM FORMATS 28
SPAM ANATOMY 29
UPDATES
For convenience, please check on this section to refer to any new additions on this report such
as, but not limited to:
 Headings,
 Spam Classifications,
 Spam Formats,
 Spam Anatomy.
For this month:
 A new heading, Security Threat, is added. Documents that have a security threat will
be included in this heading.
 All the other inclusions (documents) under the Headings category/section are new.
 The details and information under Appendices are as is.
1 | Page
MONTHLY DOCUMENTS IN NUMBERS
NOVEMBER 2020
TOTAL SPAM GROUPS REVIEWED 15
ESTIMATED DOCUMENTS REVIEWIED 44,800
ESTIMATED SPAM DOCUMENTS REVIEWED 8,626
ESTIMATED NOT SURE DOCUMENTS REVIEWED 2,870
ESTIMATED UNREACHABLE DOCUMENTS 0
Documents that were reviewed but were in a group that was not completed because of an
access-issue are not included in the table above. Not sure documents are either unconvertible or deleted
documents, with no way to place a definite spam or ham review.
2 | Page
FREQUENTLY IDENTIFIED SPAM DOCUMENTS
The succeeding pages will focus on highlighting frequently identified spam documents with the
listed spam formats below and a few extrinsic spam (please see the Appendix for a detailed description
of the different spam formats and classifications). The included documents below are the ones that have
not been categorically identified by the spam analyzer/classifier tool as a red spam, and as well as, newly
detected spam techniques, which need more training and/or additional detection features. It is for this
purpose that these spam documents are only the ones included in this report.
For reference, the two spam classifications are:
 Intrinsic Spam
 Extrinsic Spam
For reference, the mentioned spam formats are as follows:
 SEO (Search Engine Optimization)

 CTAs (Call-To-Action)
 Marketing Collaterals
 Junk Docs
A spam document could also display several characteristics from a single, several, or all of the
formats mentioned above. As such, finding or creating a new format for an identified spam document
is also a given possibility.
3 | Page
Document Title : T104_English Entrance Exam Instructions.pdf
Document Number : 452727278
Original Format : PDF
Spam Classification : Intrinsic
Spam Format : Marketing Collateral, CTA
Analyzer Review : The ML classifier classified this document at 2020-10-28 16:17:50 UTC and
decided that it was not spam with a score of 0.052.
Remarks and Analysis : This spam is disguised as a decent reading material. Upon further review, a
certain CTA in the document directs to an affiliate site – as shown in the
screenshot above. With the new GUI for the review process, spam like this can
be easily reviewed correctly even if it is disguised as a decent reading material.
Uploader Remarks : The uploader only has 2 uploaded documents of the same type. It is also
interesting to note that both two (2) documents were classified by the classifier
with relatively low spam score.
Recommendations : Include the term affiliate as a red flag in checking spam hyperlinks in the
document and assign a corresponding score. Increase the score if the term is
proceeded or preceded with an ID number as shown in the screenshot above.
A spam score for a hyperlink can also be concluded with these terms if the
utm_source is also included in the hyperlink, which means that this certain
hyperlink is being used for a marketing campaign.
4 | Page
Document Title : Burpple Sg
Original Format : DOCX
Spam Format : Marketing Collateral
Remarks and Analysis : The low score might be because there are no immediate and distinctive spam
elements in the document. The spam hyperlinks are not anchored by a CTA (call
to action) as well. There are no obvious SEO keywords as well (though the
mentioned names of the restaurants, which were used as headings, can be
considered as SEO branding). What hints it as a spam document is the use of a
superlative adjective in describing a place, which suggests that there is a
marketing intent. Upon further review, the spam attributes are all displayed in
the hyperlinks.
Uploader Remarks : This user has a total of 20 uploaded documents – a mixture of spam and ham,
thus, documents from this user should be reviewed without any significant
bearing from the user attributes.
Recommendations : Documents with hyperlinks that contains utm_campaign should be given a

higher spam score, also especially if the said term is proceeded by a superlative
adjective + noun as shown in the screenshot above.
5 | Page
Document Title : mozilla12-pdf.pdf
Spam Classification : Extrinsic
Spam Format : None
Remarks and Analysis : The document actually has no spam formats since the determining factor is
extrinsic. This might be the reason why it got a low spam score from the
classifier. However, the document included a hyperlink that can be considered
as a spam. It redirects to a website that offers a software and while it links
directly to the homepage, it can also be considered as the product/service page
of that website, where there are CTAs all over and the marketing intent is
obvious.
Uploader Remarks : All the 11 uploaded documents from this user are mostly ham, with the
exception of the above document. Documents from this user must be reviewed
without any significant bearing from the user attributes.
Recommendations : Include the spam hyperlink in the spam repository of hyperlinks. Add more of
this type of document in future spam groups to improve the analyzer’s
detection of extrinsic spam.
6 | Page
Document Title : Guia-Definitivo-Para-Criar-Um-Negocio-Online-Do-Zero…
Spam Format : CTA, Marketing Collateral
Remarks and Analysis : Spam formats and attributes are all over this document. The topic is also a red-
flag, but perhaps the low spam score was because of the document’s 100+
pages. However, each page of the document contains a CTA anchor text as a
footer. This CTA anchor text links to a spam website that offers online services
for the topic being discussed in the document.
Uploader Remarks : This user only uploaded 1 document. No other significant input can be
attributed from the user in this review process.
Recommendations : Provide an algorithm for the analyzer to ignore the number of ham pages in the
document if majority if not all of the pages includes a spam format, especially
if it’s a CTA. Also improve the detection of CTA phrases in translated text from
other languages.
7 | Page
Document Title : 0822 2083 0527 (TSEL) Jual Bibit Alpukat Mentega Di Bogor, Jual Bibit
Remarks and Analysis : This is actually just an image document and only contains a single page. The
spam CTA format is displayed in the document title. The low spam score might
be because the actual document does not contain any texts at all. However,
after translating the document title, it is obvious that there is a marketing
intent.
Uploader Remarks : The user uploaded a total of 3,731 documents and upon checking, majority if
not all of the documents are the same type of spam as the document
mentioned above. This should be an indication that the documents from this
user are highly likely to be spam as well.
Recommendations : Always include the document title as a detection location for spam attributes
or spam formats to review a document. While the document title can be edited,
spam formats like CTA can be easily inputted in the title. Also improve the
detection of translated spam texts. In the example above, the term selling is
preceded by what seems to be likely a contact number. If a number starts with
zero (0) and proceeded by a term related to buy/sell, then that number is most
likely a contact number and thus must be given a corresponding spam score.
Also, TSEL is a telecom company in Indonesia. Provide a condition that if a
phrase includes TSEL with a number and in Indonesian language, then it will
have a higher spam score.
8 | Page
Document Title : Compre o Melhor Para Seu Negocio de Artesanato
Remarks and Analysis : This document is in Portuguese language. The lower spam score given by the
classifier might be a detection issue for languages other than English. This could
had been easily identified by the classifier as spam if this was in English because
the CTA spam formats are obvious in the last pages of the document. The
marketing intent is also displayed in the title and description as show in the
screenshot above.
Uploader Remarks : The uploader has a total of 1,715 documents and upon further checking,
majority if not all are of the same type of spam. Some are still given a low score
by the classifier.
Recommendations : Improve the classifier’s detection of spam formats from documents with non-
English languages. Include the same type of document in future spam groups.
9 | Page
Document Title : 2090613 Grundlagen über Dampfbügelstation Angebot +…
Spam Format : SEO, CTA, Marketing Collateral
Remarks and Analysis : This document is in German language. This might also be the reason why the
classifier decided to give this document a lower spam score. This is actually a
product review but there is no obvious CTA texts in the document. The
document though included a hyperlink that directs to a playlist description in
YouTube and in that description, a spam hyperlink redirects to a product review
site. This is a relatively SEO technique used in uploading documents in Scribd,
where the actual spam is uploaded via a Youtube webpage, specifically in a
playlist description to somehow disguise it as a ham content.
Uploader Remarks : There is no significant bearing that can be attributed to the user in the spam
review process because the uploader only has 1 document.
Recommendations : Train the classifier to identify marketing intent clues for product reviews. The
document title includes the word offer, which can be related to the terms buy
and sell, which in turn implies a marketing intent. To do this, include documents
of the same type in future spam groups.
10 | Page
Document Title : 俄罗斯 Gost 标准，进出口购买商品目录№RG 1771

Remarks and Analysis : This document is in Chinese language. This is actually the same type of spam
previously identified but is now uploaded in a different way as shown in the
screenshot above. The left image above shows how it looks like before and the
screenshot on the right is the actual document now. It’s the same marketing
collateral material for a website that offers such product or service. The low
score might be due to the detection of translated texts and the fact that the
document is in image format.
Uploader Remarks : The uploader has a total of 400 documents and all are of the same type of spam
as the document above. Majority, if not all, of the documents were identified
by the classifier as not spam with a relatively low score.
Recommendations : Include RussianGost as a red-flag and a trigger for a spam identification. Include
this type of document in future spam groups.
11 | Page
Document Title : Study in Australia - An Indian Student’s Guide
Spam Format : SEO, CTA, Marketing Collateral
Remarks and Analysis : Despite the classifier’s review, this is actually a spam document. It is a
promotional service review and uses a local SEO technique in its CTA as shown
in the screenshot above. It also include contact details in that CTA.
Uploader Remarks : The uploader has a total of 685 documents and all are of the same type of spam
as the document above. Majority, if not all, of the documents were identified
by the classifier as not spam with a relatively low score.
Recommendations : Include Global Opportunities as a red-flag noun along with its website URL and
a trigger for a spam identification. Train the classifier to identify the different
keywords used as anchor texts in documents related to the mentioned noun,
e.g. study in + location.
12 | Page
Document Title : 76% of Canadians want a total pause on immigration
Spam Format : CTA
Remarks and Analysis : Despite the classifier’s review, this is actually a spam document. The actual
contents of the document is actually not spam, but the included CTA in the
description implies a marketing intent by asking the readers to a different
website. The website itself is not spam though, but the CTA is a clear indication
to increase the website’s traffic.
Uploader Remarks : The user attributes have no significant bearing on the review process of the
document because of the only 3 total uploaded documents.
Recommendations : Improve the classifier’s detection of CTAs in the title and description of a
document. Include more documents in future spam groups that have CTAs and
other spam formats in the title and description to improve the classifier’s
detection level.
13 | Page
SECURITY THREAT
The succeeding pages below focuses on documents that has been shown to include hyperlinks
that redirect to a website that has a high risk for a security threat, e.g. malwares.
Detection Used : Kaspersky Total Security (Kaspersky Protection browser extension),

Malwarebytes Browser Guide, Microsoft Defender Antivirus, Google Safe
Browsing.
Remarks and Analysis : Some of these documents could actually be ham and not spam at all. Regardless
of the actual contents of the documents mentioned in this section, the inclusion
of a hyperlink that redirects to a security threat merits a spam review. This has
also been the practice ever since the infancy stages of the spam review.
However, there might be an exemption to this, as explained below.
Recommendations : Upon detection of a security threat, the usual practice is to delete the
document entirely. However, if a document is not inherently considered as a
spam and might even be beneficial to the users in the platform, deleting that
document might not be the ultimate solution. In such instances, a warning in a
dialogue box might be an alternative course of action. Once a user clicks a blued
highlighted hyperlink in a document, a dialogue box that warns the user of the
possible security threat will be helpful. This will serves as a liability check so the
platform will not be held responsible if the user otherwise proceeds to visit the
external security threat.
Adding a security scanner that can detect links with security threats might also
be a viable solution to this.
14 | Page
Document Title : Hoe Kan Kaspersky Subscription-gebruiker Verlopen Fouten…
Original Format : PPTX
Analyzer Review : The bayesian analyzer analyzed this document at 2019-12-05 04:17:02 UTC and
decided that it was probably spam.
Human Review : Spam
15 | Page
Document Title : Review Doc Pinot’s Palette
Spam Format : CTA
Human Review : Spam
16 | Page
Document Title : Custom Golf Tube Socks.golfiya (1)
Spam Format : SEO
decided that it was probably spam.
Human Review : Spam
17 | Page
Document Title : 4_rahasia_menjadi_seseorang_yang_berkarisma_majala.pdf
Spam Format : Marketing Collateral
decided that it was not spam.
Human Review : Spam
18 | Page
Document Title : Sapatos Femininos Baratos
Spam Format : SEO, CTA
decided that it was spam with a score of 0.943.
Human Review : Spam
19 | Page
Document Title : DOWN MP3
Spam Classification : Extrinsic
Spam Format : None
Human Review : Spam
20 | Page
SPAM REPOSITORY
The following pages below highlight the spam documents that have been successfully reviewed
with a categorical red spam by the analyzer/classifier. These spam documents have been recurring in
many spam groups.
Additional insights could be collected from the users of these identified spam documents. Some
can be considered as a spammer account because of the number of uploaded spam documents under a
single account.
This section also serves as a reference for other spam review purposes.
21 | Page
Document Title : Air Conditioner Services Sydney
Spam Format : CTA, SEO
Remarks and Analysis : This is a promotional marketing material for a local SEO campaign, offering air
conditioning services in Sydney. The keyword used in the anchor text for the
hyperlink is an obvious SEO as shown in the screenshot above. The last page of
the document also contains a CTA with contact details.
Uploader Remarks : The user uploaded a total of 3 documents only and all are of the same type of
spam – service review for a local SEO campaign.
22 | Page
Document Title : Ambulatory Outpatient Services Director Email List
Remarks and Analysis : Global B2B Contacts LLC has long been identified as spam. This type of spam
document has been frequently appearing in several spam groups ever since.
CTAs can be seen obviously all throughout the document and contact details
are included.
Uploader Remarks : The user uploaded a total of 2,994 documents. Majority, if not all of the
documents are of the same type of spam as the document above. It is also
interesting to note that the user used a stock photo as a profile picture. All of
these are positive indication of a spam user.
23 | Page
Document Title : Daily Auctions Scraping From Manheim
Remarks and Analysis : Webscrapingexpert.com has also been previously identified as spam. This
document includes a list of several offerings for a web scraping service. Contact
details are also displayed in the last page, as show in the screenshot above.
Uploader Remarks : The user uploaded a total of 150 documents. Majority, if not all of the
documents are of the same type of spam as the document above. This is a
certain spam user.
24 | Page
Document Title : NO #1 Jasa Cat Lapangan Basket Outdoor Bogor Terjamin…
Remarks and Analysis : This document is in Indonesian language, but upon translation, it is obvious that
spam formats are all over its content. The last page include a CTA along with
the contact details, describing the services offered.
Uploader Remarks : The user uploaded a total of 35 documents. All of the documents are of the
same type of spam as the document above and are in the same language.
25 | Page
Document Title : Eye Care Some Tips And Advicerpovb.pdf
Spam Format : SEO
Remarks and Analysis : This type of document article is usually used for linkbuilding purposes in SEO.
The structuring and how it reach a certain word count is indicative of an SEO
spam. In fact, this will be posted in several web 2.0 sites where links from those
sites will redirect to a main website to increase the number of links.
Uploader Remarks : There is no significant bearing from the user in the review process since there
is only 1 uploaded document.
26 | Page
APPENDICES
SPAM CLASSIFICATION
Spam Classification is a newly added reference for the spam review process as of May 2020. This
is a higher taxonomy than the Spam Formats. Please refer to the table below for a more detailed
explanation. However, there are always exemptions to these classifications and as such, a careful review
must be made.
CLASSIFICATION DESCRIPTIONS SAMPLE DOCUMENTS
• Considered as spam purely by its own

intrinsic characteristics. Please refer to the sample
• Intrinsic characteristics include SEO, CTAs, documents in the next
and Marketing Collaterals. table below with the said
INTRINSIC SPAM • Spam intent is obvious. Spam Formats.
• Regardless of a ham website linking to a
document under this classification, the
document is still reviewed as spam.
• Cannot be considered as spam purely by its 430676827, 430676796,

own intrinsic characteristics. 431023336, 431176449,
• This means that the actual content of the 431156957
document is not a spam.
• No intent for marketing or any of the
identified Spam Formats for an intrinsic
spam.
• The only identifiable spam element is a
EXTRINSIC SPAM spam website linking to the document.
• Single page junk docs are the best example
for this classification, which usually include
links to a known website that offers
downloads for torrents, crack software, etc.
• Documents that have links to a malware or
to a similar security risk websites are under
this classification.
• This is tricky in the review process since
websites can change anytime and
registering a website as spam in the
analyzer tool with such consideration might
not be an effective method in the long run.
27 | Page
SPAM FORMATS
FORMAT DESCRIPTION INTENT SAMPLE DOCUMENTS
• Anchor texts in the form • Link Building 420756173, 420754869, 420754862, 420754861,
of either website links, • Website Traffic 420754858, 420753427, 420753424, 420753418,
keywords, or CTA (call to 420753146, 420745621, 420745354, 420742438,
• Marketing Ads 420742029, 420742022, 420742016, 420741594,
SEO action). • Contacts Scraping 420741590, 420741585, 420739628, 420739424,
• Typical blog posts or 420739046, 420738676, 420738410, 420715059,
ghostwritten articles of 420713787, 420711507, 420854229, 420840696,
products and services. 421052778, 420754549, 420754309, 420748336,
• Spun contents. 420745109, 420740223, 420740196, 420738973,
• Wall of texts. 420715131, 420855582, 420844292, 420843433,
421052397, 421051777, 421051195, 421052893
• Article contents that are • Website Traffic 420754312, 420746377, 420745388, 420743747,
not necessarily SEO but • Marketing Ads 420743289, 420740519, 420738063, 420717361,
with call to action 420714465, 420714306, 420856102, 420835944,
• Contacts Scraping
phrases to specific 420747083, 420746708, 420746220, 420739659,
CTAs 420739195, 420739128, 420738046, 420737706,
websites.
420737696, 420737683, 420752393, 420714617,
• Common phrases: click 420710481, 420706071, 420602716, 420600613,
here, visit, download, 420856357, 420856234, 420854261, 420853877,
read more, and buy. 420853363, 420852064, 420851830, 420845948,
420842901, 420839908, 421052630, 421052135
• Usual blurbs and short • Website Traffic 420744936, 420735609, 420716367, 420711274,
product and service • Marketing Ads 420706071, 420856448, 420743565, 420735411,
descriptions. 420711477, 420711387, 420853871, 420847483,
(Sale, Promotion) 420843463, 420842825, 420844897, 420841767,
MARKETING • With CTAs as well but not 420839104, 420838704, 420836233, 420835523,
COLLATERALS necessarily long articles 421052911, 421052558, 421051740, 421051724,
or blog posts. 421051609, 421051180, 421051050
• Usually includes contact
details of the
products/services.
• Read_me documents but Website Traffic 420715675, 420703813, 421049433
contain links to known
torrent sites that houses
software cracks, pirate
JUNK DOCS sites, malwares, and
other risks.
• Some contains CTAs as
well.
28 | Page
SPAM ANATOMY
SPAM ANATOMY: SEO
Common SEO spam documents usually contains either of the two (2) identifiers:
1. Anchor texts that links to a target website. These anchor texts are either actual URLs or
specific keywords for the targeted website. Below is an example of a local SEO targeting a
specific keyword suffixed with a location, with document # 420715059:
2. Link Building Articles that are usually in a Wall-of-Texts format to meet a certain word-count
number. Articles like this are usually descriptive and informative but does not create value to
the reader. Sometimes, the written content are spun from other article sources, so some
sentences do not make sense. The actual focus is always the product or service being offered
to the reader. This is obvious because the name of the product or service is always repeated
throughout the article. Sample document # 420754862:
29 | Page
SEO documents are usually less than 10 pages in length, so they are easy to identify and review.
However, not all documents that have anchor texts are reviewed as spam. This also applies to
documents that are in the wall-of-text format. Case in point are article documents that contain many
anchor texts but are directed to legitimate websites such as Wikipedia, .edu websites, .gov pages, etc.
SPAM ANATOMY: CTA
A spam CTA is a document with a single or many call to action phrases as a means to:
• Direct the reader to a specific website in order to increase that website’s traffic.
• Direct the reader to a specific landing page in order to either sell a product or service, or solicit
the reader’s contact information for future marketing purposes.
• Direct the reader to a specific website to do certain actions such as download, click, buy, etc.
Sample document # 420714465:
Sample document # 42071446:

5
30 | Page
SPAM ANATOMY: MARKETING COLLATERALS
Spam documents that are not necessarily identified as SEO or CTA, but employs a certain
marketing aspect, falls under Marketing Collaterals. These spam documents also contain some CTAs
but the format somehow differs from that of the CTA spam docs. The CTAs in this type of documents
are usually directed to the contact details of the specific product or service being offered.
Examples of these marketing collaterals are:
• Brief company profile of a certain product or service.

• Short product or service descriptions.
• Product or service reviews.
• Brochures, flyers, banners and the like with prices and heavy CTAs.
Sample documents 420711274 and 420853871 respectively:
31 | Page

November 2020 Monthly Spam Reporting

Caricato da

Informazioni sul documento

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

November 2020 Monthly Spam Reporting

Caricato da

Copyright:

Formati disponibili

MONTHLY SPAM DOCUMENTS

MONTHLY DOCUMENTS IN NUMBERS 2

FREQUENTLY IDENTIFIED SPAM DOCUMENTS 3

For this month:

TOTAL SPAM GROUPS REVIEWED 15

ESTIMATED DOCUMENTS REVIEWIED 44,800

ESTIMATED SPAM DOCUMENTS REVIEWED 8,626

ESTIMATED NOT SURE DOCUMENTS REVIEWED 2,870

ESTIMATED UNREACHABLE DOCUMENTS 0

For reference, the two spam classifications are:

For reference, the mentioned spam formats are as follows:

 SEO (Search Engine Optimization)

Recommendations : Documents with hyperlinks that contains utm_campaign should be given a

Document Number : 478167367

Detection Used : Kaspersky Total Security (Kaspersky Protection browser extension),

Human Review : Spam

Human Review : Spam

Human Review : Spam

Human Review : Spam

Human Review : Spam

Human Review : Spam

CLASSIFICATION DESCRIPTIONS SAMPLE DOCUMENTS

• Considered as spam purely by its own

• Cannot be considered as spam purely by its 430676827, 430676796,

FORMAT DESCRIPTION INTENT SAMPLE DOCUMENTS

SPAM ANATOMY: CTA

Sample document # 42071446:

Examples of these marketing collaterals are:

• Brief company profile of a certain product or service.

Potrebbero piacerti anche