Welcome to WebmasterWorld Guest from 54.167.83.224

Message Too Old, No Replies

Bogus Google Search Quality Team Warning

(I hope...)

     
6:10 am on May 10, 2007 (gmt 0)

Senior Member

WebmasterWorld Senior Member jomaxx is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Nov 6, 2002
posts:4768
votes: 0


I got an email today from the "Google Search Quality Team" about a problem with one of my websites. Strangely, the email was in German, which my website most certainly is not.

I've been waiting for someone else to mention it here, but I haven't seen anything yet. I have reason to believe it's a fake, but someone clue me in ASAP if this is a real email. The things that point to a spoofed email are:

1. I was able to find a couple of other mentions of such emails going out today (May 9). The consensus seems to be that they're a hoax, even if there's no obvious phishing/malware purpose in sending them.

2. The originating IP address appears to resolve to a an ISP in Spain.

3. The email comes from "DONOTREPLY@gmail.com", whereas legitimate Search Quality emails appear to normally come from "DONOTREPLY@google.com".

4. As of this time, I don't see any change in my google.de rankings, or in the total traffic I'm getting from Google overall.

Anyway, I'm mainly posting in hopes that other people have gotten this email and have confirmed that it's a fake. Anyone? Please?

9:39 am on May 10, 2007 (gmt 0)

Senior Member

WebmasterWorld Senior Member quadrille is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Feb 22, 2002
posts:3455
votes: 0


Was it right about the problem?

But why not ask Google?

Forward the whole thing (with headers) and I'm sure they'll be very grateful.

10:30 am on May 10, 2007 (gmt 0)

New User

5+ Year Member

joined:Apr 30, 2007
posts:27
votes: 0


Forget about that mail...

In Germany almost every webmaster has got one of those mails. They have been sent by using servers all over the world, the IP is not within Googles IP-range and the last sentence says that you'll find "a webmastertool" as attachement(!) which will easily allow you to file a reinclusion request after you fixed the mentioned problems with your site (a 301-Redirect!)...

Probably an attack with trojans or viruses, but obviously the attachement was simply forgotten or whatever...

[edited by: Pancho at 10:31 am (utc) on May 10, 2007]

11:03 am on May 10, 2007 (gmt 0)

Junior Member

10+ Year Member

joined:Mar 12, 2003
posts:196
votes: 0


If it's not within the IP range it would have to be a .de domain to qualify.
2:13 pm on May 10, 2007 (gmt 0)

Senior Member from US 

WebmasterWorld Senior Member 10+ Year Member

joined:June 12, 2003
posts:702
votes: 9


Vanessa Fox of Google has confirmed [seroundtable.com] that this email is not from Google.
3:32 pm on May 10, 2007 (gmt 0)

Senior Member

WebmasterWorld Senior Member jomaxx is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Nov 6, 2002
posts:4768
votes: 0


Whew. I was sorta sure of this already, but most of the discussion threads I could find were in German, so this is a good confirmation.

And on the bright side, I discovered a minor canonical problem that was easily fixed (my server was treating ns.domain.com as identical to www.domain.com, and Google had somehow found a few of those pages).

4:25 pm on May 10, 2007 (gmt 0)

Senior Member

WebmasterWorld Senior Member jomaxx is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Nov 6, 2002
posts:4768
votes: 0


BTW, just checked my email and I have received 2 more of these spoofed emails. This time there IS a tiny little attachment along with the email. Be warned.
4:38 pm on May 10, 2007 (gmt 0)

Preferred Member

10+ Year Member

joined:Oct 1, 2004
posts:607
votes: 0


A post has appeared on Heise with some details: [heise.de...] (Heise is the biggest IT news portal in Germany). It says many mails arrive with no attachment, the ones that do contain a "webmastertools.exe", which just does "cmd.exe c\:clear complete harddisc" (which appears to be harmless, unless you have a "c\:clear" program which accepts the commands "complete harddisc".

[edited by: zCat at 4:41 pm (utc) on May 10, 2007]