Bogus Google Search Quality Team Warning

(I hope...)

[jomaxx]

I got an email today from the "Google Search Quality Team" about a problem with one of my websites. Strangely, the email was in German, which my website most certainly is not.

I've been waiting for someone else to mention it here, but I haven't seen anything yet. I have reason to believe it's a fake, but someone clue me in ASAP if this is a real email. The things that point to a spoofed email are:

1. I was able to find a couple of other mentions of such emails going out today (May 9). The consensus seems to be that they're a hoax, even if there's no obvious phishing/malware purpose in sending them.

2. The originating IP address appears to resolve to a an ISP in Spain.

3. The email comes from "[e-mail]", whereas legitimate Search Quality emails appear to normally come from "[e-mail]".

4. As of this time, I don't see any change in my google.de rankings, or in the total traffic I'm getting from Google overall.

Anyway, I'm mainly posting in hopes that other people have gotten this email and have confirmed that it's a fake. Anyone? Please?

[Quadrille]

Was it right about the problem?

But why not ask Google?

Forward the whole thing (with headers) and I'm sure they'll be very grateful.

[Pancho]

Forget about that mail...

In Germany almost every webmaster has got one of those mails. They have been sent by using servers all over the world, the IP is not within Googles IP-range and the last sentence says that you'll find "a webmastertool" as attachement(!) which will easily allow you to file a reinclusion request after you fixed the mentioned problems with your site (a 301-Redirect!)...

Probably an attack with trojans or viruses, but obviously the attachement was simply forgotten or whatever...

[edited by: Pancho at 10:31 am (utc) on May 10, 2007]

[ashear]

If it's not within the IP range it would have to be a .de domain to qualify.

[rustybrick]

Vanessa Fox of Google has confirmed [seroundtable.com] that this email is not from Google.

[jomaxx]

Whew. I was sorta sure of this already, but most of the discussion threads I could find were in German, so this is a good confirmation.

And on the bright side, I discovered a minor canonical problem that was easily fixed (my server was treating ns.domain.com as identical to www.domain.com, and Google had somehow found a few of those pages).

[jomaxx]

BTW, just checked my email and I have received 2 more of these spoofed emails. This time there IS a tiny little attachment along with the email. Be warned.

[zCat]

A post has appeared on Heise with some details: [heise.de...] (Heise is the biggest IT news portal in Germany). It says many mails arrive with no attachment, the ones that do contain a "webmastertools.exe", which just does "cmd.exe c\:clear complete harddisc" (which appears to be harmless, unless you have a "c\:clear" program which accepts the commands "complete harddisc".

[edited by: zCat at 4:41 pm (utc) on May 10, 2007]