[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/dangers-of-clickbait-sites/) * [Japanese](https://unit42.paloaltonetworks.com/ja/dangers-of-clickbait-sites/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/ "Cybercrime") [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/) # High Traffic + High Vulnerability = an Attractive Target for Criminals: The Dangers of Viewing Clickbait Sites ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 7 min read Related Products [![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Shresta Bellary Seetharam](https://unit42.paloaltonetworks.com/author/shresta-bellary-seetharam/) * [Tao Yan](https://unit42.paloaltonetworks.com/author/tao-yan/) * [Nabeel Mohamed](https://unit42.paloaltonetworks.com/author/nabeel-mohamed/) * [Tim Hofmockel](https://unit42.paloaltonetworks.com/author/tim-hofmockel/) * [Alex Starov](https://unit42.paloaltonetworks.com/author/alex-starov/) * [Brad Duncan](https://unit42.paloaltonetworks.com/author/brad-duncan/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:November 9, 2023 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * [Vulnerabilities](https://unit42.paloaltonetworks.com/category/vulnerabilities/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [CVE-2023-3169](https://unit42.paloaltonetworks.com/tag/cve-2023-3169/) * [Web threats](https://unit42.paloaltonetworks.com/tag/web-threats/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/dangers-of-clickbait-sites/?pdf=download&lg=en&_wpnonce=b82091c0d3 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/dangers-of-clickbait-sites/?pdf=print&lg=en&_wpnonce=b82091c0d3 "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=High%20Traffic%20+%20High%20Vulnerability%20=%20an%20Attractive%20Target%20for%20Criminals:%20The%20Dangers%20of%20Viewing%20Clickbait%20Sites&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fdangers-of-clickbait-sites%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fdangers-of-clickbait-sites%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fdangers-of-clickbait-sites%2F&title=High%20Traffic%20+%20High%20Vulnerability%20=%20an%20Attractive%20Target%20for%20Criminals:%20The%20Dangers%20of%20Viewing%20Clickbait%20Sites "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fdangers-of-clickbait-sites%2F&text=High%20Traffic%20+%20High%20Vulnerability%20=%20an%20Attractive%20Target%20for%20Criminals:%20The%20Dangers%20of%20Viewing%20Clickbait%20Sites "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fdangers-of-clickbait-sites%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=High%20Traffic%20+%20High%20Vulnerability%20=%20an%20Attractive%20Target%20for%20Criminals:%20The%20Dangers%20of%20Viewing%20Clickbait%20Sites%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fdangers-of-clickbait-sites%2F "Share in Mastodon") ## Executive Summary Since the end of August 2023, we have observed a significant rise in compromised servers specializing in clickbait and ad content. But why are sites like this such an attractive target for criminals? Mainly because these sites are designed to reach a large number of potential victims. Furthermore, clickbait sites often use outdated or unpatched software, making them vulnerable to compromise. This article educates readers on the dangers of clickbait articles. We discuss how clickbait sites increase traffic for ad revenue. Additionally, we review a strategy to detect vulnerable clickbait sites based on the characteristics of their web traffic. Finally, we reveal trends on the recent jump in compromised clickbait sites based on exploitation of [CVE-2023-3169](https://nvd.nist.gov/vuln/detail/CVE-2023-3169). Palo Alto Networks customers receive protection from compromised clickbait sites through our [Next-Generation Firewall](https://www.paloaltonetworks.com/network-security/next-generation-firewall) with [Cloud-Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions), including [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire), [DNS Security](https://www.paloaltonetworks.com/network-security/dns-security) and [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering). |----------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Related Unit 42 Topics** | [**CVE-2023-3169**](https://unit42.paloaltonetworks.com/category/cve-2023-3169/)**,** [**Vulnerability**](https://unit42.paloaltonetworks.com/category/Vulnerability/)**,** [**Web Threats**](https://unit42.paloaltonetworks.com/tag/web-threats/) | ## Clickbait Sites and Ad Traffic [Clickbait](https://www.merriam-webster.com/dictionary/clickbait) is best described as a link to web content of dubious value, designed to make readers want to click it. Sites specializing in clickbait content exist for the sole purpose of generating advertising (ad) revenue. As a result, webpages from clickbait sites contain a great deal of intrusive ads. Clickbait requires a significant number of views to generate ad revenue, so these sites often use the following three strategies to increase their traffic. * Evergreen topics * Content discovery platforms * Generative artificial intelligence (AI) tools ### Evergreen Topics One strategy to increase traffic is focusing on [evergreen](https://ahrefs.com/blog/evergreen-content/#:~:text=Evergreen%20topics%20are%20topics%20with,time.) topics. Evergreen describes topics that are not tied to a particular time or place and people continue to find them interesting. For example, finance and health are considered evergreen topics. Figure 1 and Figure 2 show two examples of pages from clickbait sites. ![Image 1 is a screenshot of a website publishing a finance-themed clickbait article. How to check how much money is in my 401(k). The site is cluttered with buttons and ads. There's a column for popular articles. There are content categories at the top of the website such as account, cash, contribution, and more. The article publication date is Tuesday, October 24, 2023.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131181-1.jpeg) Figure 1. Example of a finance-themed clickbait article. ![Image 2 is a screenshot of a website publishing a health-themed clickbait article. Ear infection cause tooth pain. Can a bad tooth cause headache and neck pain. The site has options to click on for searches on health related topics, ads, share buttons, and other content topics to choose from. The publication date of the article is Monday, October 23, 2023.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131181-2.jpeg) Figure 2. Example of a health-themed clickbait article. ### Content Discovery Platforms Since clickbait content is itself distributed through ads, many clickbait sites also rely on a second strategy to increase traffic: [content discovery platforms](https://en.wikipedia.org/wiki/Content_discovery_platform). News organizations and other content providers use content discovery platforms to generate revenue. Clickbait providers often hire these services to drive traffic to their own content. Content discovery platforms often use techniques to disguise ads. One such method is called [native advertising](https://www.outbrain.com/native-advertising/). This method configures ad content to resemble the look and feel of the site on which it appears. As a result, viewers can have difficulty distinguishing between the site's original content and the ad content. Figure 3 shows examples of native ads appearing on a news site. ![Image 3 is a screenshot of a site with native ads. A red arrow points to an AI generated image of an elderly woman clutching her head. Below is the title of the advertisement: Warning signs of plaque psoriasis that shouldn't be ignored, click here for… Some of the information is redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131181-3.png) Figure 3. Example of native ads appearing on a news site. In Figure 3, we added a red arrow pointing to clickbait content hosted at hxxps://gofindyou\[.\]com/health/what-causes-plaque-psoriasis-heres-what-doctors-need-you-to-know. A quick check reveals this site was running at least one piece of outdated software. The HTML code from the webpage indicates it uses a WordPress plugin for [Yoast SEO](https://yoast.com/wordpress/plugins/seo/) shown below in Figure 4. ![Image 4 is a screenshot of the source code for one of the clickbait pages. It uses the Yoast SEO plugin. This site is optimized with the Yoast SEO plugin v20.8](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131181-4.jpeg) Figure 4. HTML code of a clickbait page showing Yoast SEO plugin v20.8. The HTML showing Yoast SEO plugin version 20.8 was originally released on May 23, 2023. The webpage shown in Figure 4 was served on Oct. 27, 2023, when the most current version of the Yoast SEO plugin was [21.4](https://developer.yoast.com/changelog/yoast-seo/21.4/), making this plugin out-of-date. We routinely discover clickbait sites with outdated software or plugins. (This specific case does not imply any specific vulnerability, but outdated software can be more vulnerable than fully patched versions.) ### Generative AI Tools The newest strategy for clickbait authors is using generative AI tools like [Jasper](https://www.jasper.ai/) and [AIPRM](https://www.aiprm.com/). These tools provide an easy method to generate SEO-optimized content to increase site traffic. (Threat actors often abuse, take advantage of or subvert legitimate products for malicious purposes. This does not necessarily imply a flaw or malicious quality to the legitimate product being abused.) One example is an article written with ChatGPT at hxxps://delhiproduct\[.\]info/top-24-earn-money-with-paid-online-surveys as [demonstrated in a YouTube video](https://www.youtube.com/watch?v=Ard9ZT4wvhk). In this example, the website is a WordPress site that runs an outdated version of the [MonsterInsights](https://www.monsterinsights.com/) plugin (version 8.1.0) as shown below in Figure 5. ![Image 5 is a screenshot of the source code for one of the clickbait pages. It uses the Google Analytics by MonsterInsights SEO plugin. This site is optimized with the Yoast SEO plugin v.8.1.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/11/word-image-131181-5.jpeg) Figure 5. HTML from delhiproductinfo\[.\]com reveals outdated MonsterInsights plugin. As of Oct. 3, 2023, the most [current version](https://www.monsterinsights.com/changelog/) of the MonsterInsights plugin is 8.20.1. This means the 8.1.0 version is at least two years out-of-date. The 8.1.0 version of this plugin is also [vulnerable to a stored XSS attack](https://www.linkedin.com/pulse/wordpress-google-analytics-plugin-vulnerability-over-3-cristello/). ## Finding Vulnerable Sites To compromise any website, attackers must know the [web stack](https://www.techtarget.com/whatis/definition/Web-stack) used by the site's web server. This data includes the operating system, web content management software (CMS), and any associated plugins and themes. Threat actors use web stack data to determine if a server is running any out-of-date software or applications. Armed with this information, attackers can easily find publicly known vulnerabilities and exploits to compromise the website. How can we determine a server's web stack? We can discover this information through a website's URL patterns, HTML content and functionality. A webpage's look and feel can also provide clues. Table 1 provides examples of indicators that can reveal parts of a site's web stack. |---------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Pattern** | **Description** | | /wp-content/ or /wp-includes/ | Either of these strings in a URL or a webpage's HTML code indicates the associated site might use WordPress. | | wp-content/themes/Newspaper/style.css?ver=11.4.1 | Within a webpage's HTML code, this string indicates the site uses [tagDiv's Newspaper theme for WordPress](https://tagdiv.com/newspaper/) and the Newspaper version is 11.4.1. | | \