Just Dork and Crawl: Measuring Illegal Online Gambling Defacement in Indonesian Websites

TL;DR

This paper presents a lightweight, systematic approach combining dorking and crawling to measure the scale and behavior of illegal online gambling website defacements in Indonesia, revealing persistent and diverse defacement patterns.

Contribution

The study introduces a reliable, reproducible methodology for measuring website defacement related to illegal gambling, demonstrating its effectiveness in capturing scale and dynamics.

Findings

Identified 453 defaced webpages in one month

Captured 8,837 unique third-party URLs across 5,930 domains

Average website response time was 75.3 hours

Abstract

This study investigates the defacement of Indonesian websites by actors promoting illegal online gambling. Using a lightweight methodology that combines keyword-driven dorking with systematic crawling, we identified 453 defaced webpages within one month. Although dorking alone yielded a false positive rate of approximately 20.3\%, the integration of crawling and keyword-counting enabled reliable differentiation between true and false positives. Our measurements revealed diverse defacement behaviors, including repeat defacements (150 cases), fixed instances (129), keyword modifications (55), and redirections or hidden URL injections. In total, 8,837 unique third-party URLs spanning 5,930 domains were captured, with a small subset recurring across multiple sites. Website responses were inconsistent, with an average reaction time of 75.3 hours. These findings demonstrate that simple, reproducible techniques can provide meaningful insights into the scale, persistence, and dynamics of defacement, highlighting the importance of continuous measurement for strengthening defenses against online gambling activities.