Proxy Server URLs Can Hijack Your Google Ranking - how to defend? - Google Search and SEO forum at WebmasterWorld

I posted about this in the back room but I think this need to be brought into public view. This is happening right now and could happen to you!

Over the weekend my index page and now some internal pages were proxy hijacked [webmasterworld.com] within Google's results. My well ranked index page dropped from the results and has no title, description or cache. A search for "My Company Name" brings up (now two) listings of the malicious proxy at the top of the results.

The URL of the proxy is formatted as such:
https://www.scumbagproxy.com/cgi-bin/nph-ssl.cgi/000100A/http/www.mysite.com

A quick search in Google for "cgi-bin/nph-ssl.cgi/000100A/" brings up now 55,000+ results when Saturday it was 13,000 and Sunday it was 30,000. The number of sites affected are increasing exponentially and your site could be next.

Take preventative action now by doing the following...

1. Add this to all of your headers:

<base href="http://www.yoursite.com/" />

and if you see an attempted hijack...

2. Block the site via .htaccess:

RewriteCond %{HTTP_REFERER} yourproblemproxy\.com

3. Block the IP address of the proxy

order allow,deny
deny from 11.22.33.44
allow from all

4. Do your research and file a spam report with Google.
[google.com...]

#!/usr/bin/perl use Socket; $� = 1; # Turn off buffering my $ipstartb = ''; my $ipendb = ''; my $cidrranges = ''; my $ipblocklist = ''; my $ipallow = ''; my $real-ip; my $hostname; my $retval; my $pass1 = "y"; my $logline; my $host; my $rest; my $refer; my $agent; my $file; my $sw; # # Open the bad guys list and setup the filter # open(FILE, "/etc/apache2/ipblock2"); @raw_data = <FILE>; close FILE; foreach $ip(@raw_data) { chop($ip); $ipblocklist{$ip} = "b"; } # # Open the good guy list and setup the pass through # open(FILE, "/etc/apache2/ipallow2"); @raw_data = <FILE>; close FILE; foreach $ip(@raw_data) { chop($ip); $ipallow{$ip} = "a"; } # # Open the cidr webhost and bogon list # open(FILE, "/etc/apache2/cidrlist"); @cidr_list = <FILE>; close FILE; # # The following commented out code is for testing it allows existing # log files to be used # #open(DB, "</etc/apache2/logyyy") or &cgierr("error in search. unable to open database: logyyy. Reason: $!"); #while (<DB>) #{ # ($host,$user,$date,$rest)= $_=~m,^([^\s]+)\s+-\s+([^ ]+)\s+\[(.*?)\]\s+(.*),; # if ($rest) # { # ($rtype,$file,$proto,$code,$bytes,$r2)=split(/\s/,$rest,6); # if ($r2) # { # my @Split=split(/\"/,$r2); # $agent=$Split[3]; # } # } #$logline="$agent��$host��$file"; #doit($logline); #} #close DB; #sub doit #{ while (<STDIN>) { chomp; #my ($agent, $rhostaddr, $url) = split(/\�\�/, $_[0], 3); my ($agent, $rhostaddr, $url) = split(/#######/, $_, 3); # got a bad boy send him some special content if ($ipblocklist{$rhostaddr} eq "b") { print "/403.shtml\n"; } else { # got a known good guy send him what he asked for if ($ipallow{$rhostaddr} eq "a") { print "$url\n"; } else { # # handle the cidr rang lists # note we even cache the range information for subsequent use # $sw = "n"; $ipint = unpack("N", pack("C4", split(/\./, $rhostaddr))); foreach $crange(@cidr_list) { if ($sw ne "y") { $crange =~ s/\n//g; if ($cidrranges{$crange} ne "y") { ($x, $mask) = split( /\//, $crange ); ($a,$b,$c,$d) = split( /\./, $x ); $ipstart = &ip2net( $crange ); $ipstartint = unpack("N", pack("C4", split(/\./, $ipstart))); $size = 2 ** ( 32 - $mask ); $ipend = &int2ip( unpack("N", pack("C4", split(/\./, $ipstart)))+$size ); $ipendint = unpack("N", pack("C4", split(/\./, $ipend))); $cidrranges{$crange} = "y"; $ipstartb{$crange} = $ipstartint; $ipendb{$crange} = $ipendint; if( ($ipint >= $ipstartint) && ($ipint < $ipendint) ) { $ipblocklist{$rhostaddr} = "b"; open (FD, ">>/etc/apache2/ipblock2"); print FD "$rhostaddr\n"; close FD; open (FD, ">>/etc/apache2/scrappersblock2"); print FD "$rhostaddr\n"; close FD; $sw = "y"; print "/403.shtml\n"; } } else { $ipstartint = $ipstartb{$crange}; $ipendint = $ipendb{$crange}; if( ($ipint >= $ipstartint) && ($ipint < $ipendint) ) { $ipblocklist{$rhostaddr} = "b"; open (FD, ">>/etc/apache2/ipblock2"); print FD "$rhostaddr\n"; close FD; open (FD, ">>/etc/apache2/scrappersblock2"); print FD "$rhostaddr\n"; close FD; $sw = "y"; print "/403.shtml\n"; } } } } # # Handle noagent requests # if ($agent eq "" && $sw ne "y") { $ipblocklist{$rhostaddr} = "b"; open (FD, ">>/etc/apache2/ipblock2"); print FD "$rhostaddr\n"; close FD; open (FD, ">>/etc/apache2/agentblock1"); print FD "$rhostaddr\n"; close FD; print "/403.shtml\n"; } else { # # Check for some known downloaders # if (((index($agent,"lwp-trivial") >= 0) �� (index($agent,"Wget") >= 0)) && $sw ne "y") { $ipblocklist{$rhostaddr} = "b"; open (FD, ">>/etc/apache2/ipblock2"); print FD "$rhostaddr\n"; close FD; open (FD, ">>/etc/apache2/agentblock2"); print FD "$rhostaddr\n"; close FD; print "/403.shtml\n"; } else { # # Handle Google/Media Partners # if (((index($agent,"Googlebot/") >= 0) �� (index($agent,"Mediapartners-Google/") >= 0)) && $sw ne "y") { $hostname = hostname($rhostaddr); if (index($hostname,"googlebot") >= 0) { $real_ip = inet_ntoa(inet_aton($hostname)); if($real_ip == $rhostaddr) { $ipallow{$rhostaddr} = "a"; open (FD, ">>/etc/apache2/ipallow2"); print FD "$rhostaddr\n"; close FD; print "$url\n"; } else { $ipblocklist{$rhostaddr} = "b"; open (FD, ">>/etc/apache2/ipblock2"); print FD "$rhostaddr\n"; close FD; open (FD, ">>/etc/apache2/fakegoogleblock1"); print FD "$rhostaddr\n"; close FD; print "/403.shtml\n"; } } else { $ipblocklist{$rhostaddr} = "b"; open (FD, ">>/etc/apache2/ipblock2"); print FD "$rhostaddr\n"; close FD; open (FD, ">>/etc/apache2/fakegoogleblock2"); print FD "$rhostaddr\n"; close FD; print "/403.shtml\n"; } } else { # # Handle Slurp # if ((index($agent,"Slurp") >= 0) && $sw ne "y") { $hostname = hostname($rhostaddr); if ((index($hostname,"inktomisearch.com") >= 0) �� (index($hostname,"yahoo.net") >= 0)) { $real_ip = inet_ntoa(inet_aton($hostname)); if($real_ip == $rhostaddr) { $ipallow{$rhostaddr} = "a"; open (FD, ">>/etc/apache2/ipallow2"); print FD "$rhostaddr\n"; print "$url\n"; } else { $ipblocklist{$rhostaddr} = "b"; open (FD, ">>/etc/apache2/ipblock2"); print FD "$rhostaddr\n"; close FD; open (FD, ">>/etc/apache2/fakeyahooblock1"); print FD "$rhostaddr\n"; close FD; print "/403.shtml/\n"; } } else { open (FD, ">>/etc/apache2/ipblock2"); print FD "$rhostaddr\n"; close FD; open (FD, ">>/etc/apache2/fakeyahooblock2"); print FD "$rhostaddr\n"; close FD; $ipblocklist{$rhostaddr} = "b"; print "/403.shtml\n"; } } else { if ((substr($url,0,10) eq "/forbidden") && $sw ne "y") { $ipblocklist{$rhostaddr} = "b"; open (FD, ">>/etc/apache2/ipblock2"); print FD "$rhostaddr\n"; close FD; open (FD, ">>/etc/apache2/badbotblock1"); print FD "$rhostaddr\n"; close FD; print "/403.shtml\n"; } else { print "$url\n"; } } } } } } } } sub hostname { my (@bytes, @octets, $packedaddr, $raw_addr, $host_name, $ip ); if($_[0] =~ /[a-zA-Z]/g) { $raw_addr = (gethostbyname($_[0]))[4]; @octets = unpack("C4", $raw_addr); $host_name = join(".", @octets); } else { @bytes = split(/\./, $_[0]); $packedaddr = pack("C4",@bytes); $host_name = (gethostbyaddr($packedaddr, 2))[0]; } return($host_name); } sub int2ip { local($ip) = @_; return join(".", unpack("C4", pack("N", $ip))); } sub ip2net { local($ip) = @_; ($ip2net, $ip2cidr) = split(/\//, $ip); return &int2ip(unpack("N", pack("C4", split(/\./, $ip2net))) & ~ ( 2 ** (32 - $ip2cidr) - 1)); }

Proxy Server URLs Can Hijack Your Google Ranking - how to defend?

synergy

casua

casua

tedster

casua

tedster

CainIV

kwasher

bytb

blend27

loudspeaker

spacecadet2

tedster

spacecadet2

tedster

spacecadet2

Erku

tedster

Erku

tedster

Hissingsid

Erku

USCountytrader

theBear

chazeo

Join The Conversation

Moderators and Top Contributors

Hot Threads This Week