Forum Moderators: Robert Charlton & goodroi
There are three sites that I am aware of that have created doorway pages with trademarked terms with viruses on them (that appear in google). While there SEO skills are fairly poor - I use the option to see results in last 24 hours to know how many times the company name / trademarks have been mentioned - I am concerned about people searching for company names and getting infected; one of the sites is listed on the second page of a regular search targeting a trademark. It is impossible for me to know; But, it looks like their pages have been created with the purpose of distributing the virus ... this may be politically motivated.
The virus is very nasty. It targets webmaster's computer systems and adds an iframe to the html and php files on their computer. When the webmaster uploads a page their website distributes the virus. I have avast virus scanner which detects it. Although these pages may be using a javascript redirect based on my avast log.
I am not going to link or say the domain sites here - For obvious reasons. My question is how and who do i communicate with at google concerning their safe browsing program to deal with these sites.
[edited by: tedster at 5:07 am (utc) on Aug. 17, 2009]
There are essentially four public channels for communicating with Google, as detailed in our Forum Charter [webmasterworld.com].
However, there is also a direct report page for "badware" reports at:
[google.com...]
[edited by: tedster at 6:04 am (utc) on Aug. 17, 2009]
I hate the idea of reporting people to google, but they can do serious harm with those viruses to people who don't have computer skills.
Vundo is now propagated in many different variations on websites and PC's. It is notorious for infecting files that are unknowingly uploaded via FTP to the web, and then spreads by download as you have mentioned.
In some cases it's possible to determine that a specific hosting service is botnet-friendly - again they are well-known to (it seems) everyone except law-enforcement agencies. Surely google could kill the hosting service by IP range?
In any case, how long does it take a new site to be indexed and get a good rating? Most people seem to wait weeks if not months so why do virus sites register so quickly and so well? Cloaking presumably plays a part in deceiving google and their collaborators but quick-reacting "topical" virus exploits still seem to get in very quickly.
I submitted a detection pattern to google some time ago to detect hijacked forums. No reply, no action: the forums are still listed in SERPS. Since they are obviously neglected by their owners it would have caused no harm to block them.
Surely google could kill the hosting service by IP range?
I wonder if the reason why that doesn't happen is doing so might create a legal liability for Google? Removing malware-tainted sites upon discovery is not the same as removing IP ranges where such "might" occur. Not giving legal advice, just observing that in the law there is the concept of assumed liability wherein one party takes it upon themselves to do "x"--whatever "x" might be. Taking that route might make Google liable for damages if they FAILED to catch one of those IP ranges. So, by being "reactive" instead of "proactive" that liability cannot exist.
Purely speculation on my part (but I'll bet I'm not far off the mark!).
It should be possible, though, to send bots to known bad ranges more often to check for exploits. Preferably from non-google IPs and disguised as people - hey, they already do that last bit on our sites anyway!
There was a similar case where ISPs wanted to scan their broadband customers for virus traffic and terminate the connection if found. Would have been a good inroad into botnets but the legal people said no.
I wonder what the legal position is re: google showing actual virus sites in their listings, especially if they don't flag them and it can be proven the site / IP is a known exploit.
I finally gave up since Google still lists the site at #1 and does not have any warning on it.
[edited by: Robert_Charlton at 11:40 pm (utc) on Aug. 17, 2009]
The doorways get uploaded to a random directory of a random directory and they are PHP files. Sooner or later a site will get infected that has a higher ranked pages.
The doorways are interlinked and contain variations of keywords that one may find in the news (or blogs?). The structure is such that Google should be able to see them as duplicates across the internet when ever they choose to act. The keyword variations may or may not be different across different sites? One would need to look at one of the PHP files.
[google.com...]
Thanks to SE Roundtable [seroundtable.com] for highlighting this opportunity.
