Forum Moderators: phranque

Message Too Old, No Replies

Port Sniffing

Can someone help me stop people doing this?

         

exmoorbeast

9:11 pm on Jul 29, 2004 (gmt 0)

10+ Year Member



Hi

We seem to be getting hijacked in the search engines and I wonder if there is a way to see if someone is sniffing on port 80. I am fairly non technical but I have been advised by our Network Manager that this is happening and I'd like to try and find a solution to this so I can help him.

Thanks

g1smd

10:12 pm on Jul 29, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



All of your web-traffic is being served on Port 80, so I don't follow the question.

jatar_k

10:31 pm on Jul 29, 2004 (gmt 0)

WebmasterWorld Administrator 10+ Year Member



>> I have been advised by our Network Manager that this is happening

hmmm, you might want them to explain it better then because I don't see the point of anyone sniffing port 80.

I also don't really understand what that would have to do with search engines.

>> We seem to be getting hijacked in the search engines

Is someone stealing your content? Or do you mean something else?

exmoorbeast

12:45 am on Jul 30, 2004 (gmt 0)

10+ Year Member



thanks, i didn't really get it either, but I'll try and explain.

Basically people are intercepting our search results, some kind of cloaking. When we try and find out site in Google, it just shows a load of Russian sites, or casino sites instead. When you click those links, up our site comes instead of theirs.

Does that make sense? If not terribly sorry for being a thicko!

jdMorgan

1:31 am on Jul 30, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



This sounds like conventional SERP hijacking, done with copied content and/or meta-refresh tricks, not any kind of sniffer problem. Sniffers are risky to use (you have to have access to "the wire" to do it), and usually are employed to get into secure accounts... almost always an "inside job" at the hosting facility or backbone provider.

Use a secure browser (not IE) with all scripting disabled, and see if you can find those pages that link to your site or use your content or domain name. View the source code, and look for an angle you can use to get those pages removed from Google, or to defeat the tricks they are using.

We've had several discussions over the past year of exploits used to hijack search results in the Google forum -- you might want to search for those.

Jim