Detecting Gambling SEO Spam on Academic Domains using Structural and Textual Features: A Domain-Holdout Evaluation

Abstract

SEO spam practices related to gambling on Indonesian academic domains pose dual risks: they undermine the integrity of institutional websites and impose an operational burden on security teams tasked with distinguishing compromised pages from legitimate content. This study develops a supervised detection approach to identify gambling-related SEO spam pages on .ac.id domains using a rigorously curated reference dataset. The final dataset contains 2,003 manually annotated pages collected from 938 unique domains, comprising 815 malicious pages and 1,188 benign pages. The proposed pipeline combines textual signals from character-level TF-IDF with structural page indicators, including hidden elements, suspicious links, iframes, and external-link patterns. To avoid overly optimistic performance estimates, evaluation was conducted using a domain-holdout protocol, in which 20% of the domains were completely excluded from model training and selection. Five models were compared: a keyword-based baseline, Naïve Bayes with word-level TF-IDF, Random Forest with structural features, and hybrid Logistic Regression and Support Vector Machine (SVM) models. Experimental results on the holdout set show that Random Forest with structural features achieved the highest F1-score of 0.8844, whereas the proposed hybrid SVM achieved the highest precision of 0.9205, with an F1-score of 0.8663. These findings indicate that structural compromise signals are more robust than textual cues in detecting stealthy SEO spam scenarios, while hybrid models remain promising when high precision and interpretability are prioritized.