An exemplary method for protecting web browsers from spam includes providing a multi-layer model that includes a doorway layer, a redirection domain layer, an aggregator layer, a syndicator layer and an advertiser layer; identifying domains as being associated with at least one of the layers; and, based at least in part on the identifying, taking one or more corrective actions to protect web browsers from search spam. An exemplary method for identifying a bottleneck layer in a multi-layer spam model includes providing a multi-layer spam model, collecting spam advertisements, associating a block of IP addresses with the collected spam advertisements and identifying a bottleneck layer based on the block of IP addresses. Other methods, systems, etc., are also disclosed.