1. A method comprising: providing a multi-layer model that comprises: an advertiser layer associated with advertisers that compensate syndicators to display advertisements; a syndicator layer associated with the syndicators that buy click traffic from aggregators for the advertisements; an aggregation layer associated with the aggregators that buy the click traffic from spammers to insulate the syndicators and the advertisers from being associated with spam content; a redirection layer associated with redirection domains used by the spammers to fetch the spam content after a doorway web page is clicked; and a doorway layer associated with doorway web pages that the spammers promote to top search result positions to attract the click traffic; identifying, based on an analysis of the multi-layer model, the aggregation layer as a bottleneck layer that uses at least one Internet Protocol (IP) block to funnel the advertisements and to associate the advertisements with the spam content; and performing, by one or more processors configured with executable instructions, one or more corrective actions that act on the bottleneck layer to protect web browsers from search spam.
1. A method comprising: providing a multi-layer model that comprises: an advertiser layer associated with advertisers that compensate syndicators to display advertisements; a syndicator layer associated with the syndicators that buy click traffic from aggregators for the advertisements; an aggregation layer associated with the aggregators that buy the click traffic from spammers to insulate the syndicators and the advertisers from being associated with spam content; a redirection layer associated with redirection domains used by the spammers to fetch the spam content after a doorway web page is clicked; and a doorway layer associated with doorway web pages that the spammers promote to top search result positions to attract the click traffic; identifying, based on an analysis of the multi-layer model, the aggregation layer as a bottleneck layer that uses at least one Internet Protocol (IP) block to funnel the advertisements and to associate the advertisements with the spam content; and performing, by one or more processors configured with executable instructions, one or more corrective actions that act on the bottleneck layer to protect web browsers from search spam. 4. The method of claim 1 , wherein the multi-layer model models redirection spam.