Malware sites seem to have hacked Google image results

[cabbie]

Hi,
I was doing a search in google for some images (hotels mainly) and when I click on most top results, I actually get redirected to a different site that is on google's image results.Either to .ru sites or wordpress blogs.After checking results from different pcs to make sure I didn't have malware and then asking my isp to check their results and they confirmed they had same results as me I thought my isp had been hacked, especially when friends weren't getting the same results in other countries.
On closer look it seems that some scammer is generating a lot of hotlinks to favourite images from .ru sites or hacked wordpress sites and installing malware from unsuspecting visitors.They then seem to fool google as the originator of the image. Somehow it seems to be escaping Google's malware detection also.
If I search for a image of Puerto Rico, I get the PR flag from the Cia website. However clicking the image in Google search, I get a different website as the host. Again, it is not happening on all google Data centers.
Anyone else seen this?

[lucy24]

I've noticed something analogous: Some of my hotlinks come through google Preview rather than a direct human visit.

You have to conclude that it doesn't set off any major flags when every image on a page is hosted on a different domain. If it counted against them,* the page wouldn't be successful enough to float to the top of Image Search, or get itself previewed. Would it?

I've excluded a lot of directories from Image Search purely because they'll end up as hotlink fodder. Now, if you hotlink to an image that was already hotlinked in the first place...


* It should-- not simply on ethical grounds but because a page loaded down with hotlinks makes for a horrendous user experience. Isn't there a place where google measures page load time?

[Sgt_Kickaxe]

This is possibly a by-product of the penguin update. You'll remember that on the day of the update, and for a few days after, natural serps were a mess. The human raters must have been busy and the image directory isn't as important to Google but I'm sure they'll iron the image results out too.

Hopefully they get to it soon, any perceived weakness is sure to get pounced on harder in the future.

[tedster]

Isn't there a place where google measures page load time?

Oh yes - directly from Chrome users as well as toolbars. It's just that for now at least, it's a relatively light-weight ranking factor.

[edited by: tedster at 10:55 pm (utc) on May 24, 2012]

[cabbie]

Here is some more info on it.
I am surprised that there is not much noise about this.
[link removed - it's been hacked!]

"When the scraper finds an image that matches the desired keywords, they simply put up a hotlink to the image instead of hosting it themselves.
After a while the rogue website becomes popular due to the high amount of traffic and / or stolen content and when people perform a search for black dragon tribal for example in Google, the rogue websites will most likely show up on the first two pages."

Also
[blog.unmaskparasites.com...]

[edited by: tedster at 8:05 pm (utc) on May 26, 2012]

[tedster]

Thanks, cabbie. We normally don't publish links to blogs unless they contain information from Google "authorities", but that's a very reputable blog and the information really needs attention.

[AndyA]

My question is: why does Google consider the site that hotlinks an image to be the "owner" of the image? Seems simple enough to give credit to the site where the image is actually hosted, not the one doing the hotlinking.

[tedster]

Andy, I think they just lose the ownership, the same way they do with content scrapers. It's been a long term problem.

[lucy24]

Except that with hotlinks, the image's real home remains visible to the naked eye. That is, the html-reading eye. If the site is at example.com while all its images live at example.org, you might reasonably conclude that the two domains are related. But if the images live at example.aa, example.bb, example.cc and so on, with no two alike, wouldn't a robot of ordinary robotic intelligence begin to suspect some hanky-panky?

[tedster]

I think part of the challenge is that many sites serve their images from a different domain - sometimes extremely different - to allow more parallel http calls. So Google can't assume that situation is always a hotlink.

[Kendo]

Except that with hotlinks, the image's real home remains visible to the naked eye.

There must be some discernible differences:

- an intelligible ALT tag?
- related text on the page?
- related meta tags?

[lucy24]

I think part of the challenge is that many sites serve their images from a different domain - sometimes extremely different - to allow more parallel http calls. So Google can't assume that situation is always a hotlink.

Uhm, that was my point. If the images all live at a single domain-- even if it happens to be different from the page's domain-- there can be reasonable explanations. But when every single image comes from a different place, that ought to set off alarms. Hotlinkers rarely stop at just one.

[loner]

Hotlinkers rarely stop at just one.

It sure hasn't stopped Goo from hot-linking.

[keyplyr]

What I've seen, that may appear to be what cabbie thinks is happening, is the original image host site is just using a no frame script so when a user clicks on the Google or Bing image thumb, the user is taken to the page on the host site where the original image is found. Nothing new here.

[zeus]

Yes that has been going on for a week or so, that is now possible be cause they rank the images differently after panda, if you are placed "ok" on web search you will also have good chance to rank good on google image, be fore it was as if the image was more important. There is more to it but then it gets complicated to write.

[not2easy]

Here is some more info on it.
I am surprised that there is not much noise about this.
[stopmalvertising.com...]

When I click there it goes somewhere else..it shows a bunch of Karaoke links, a note for the webmaster to contact hostgator and other links, but nothing about hotlinking or images.

[edited by: tedster at 8:07 pm (utc) on May 26, 2012]

[tedster]

When I click there it goes somewhere else..it shows a bunch of Karaoke links

Now that's some real irony - they've been hacked?

[incrediBILL]

This type of activity has been going on for a long time.

I nuked all my images in Google's index search, that was a few YEARS ago, just to not be associated with the nonsense going on and shortly afterwards they started hot-linking direct from my site! Pretty easy to spot a bandwidth spike when you have 40K+ images that suddenly get hot-linked.

I quickly installed anti-hotlink code in my .htaccess file and have left it that way ever since.

Why Google doesn't simply use the same anti-hotlink code to block them from doing this is mind blowing IMO. Google seems to go to extremes now to stop scrapers from ripping off their SERPs but images don't seem to be an issue for them.