Forum Moderators: buckworks & skibum

Message Too Old, No Replies

Account Suspended - Malicious Software?

         

La_Valette

1:31 am on Jan 10, 2008 (gmt 0)

10+ Year Member



Google today informed us that one of our accounts had been suspended. The destination url of one of our adgroups was cited as possibly having malicious software on it.

The destination url in question is simply a page on one of our servers which loads a javascript redirect to the website of a client merchant we advertise for. We believe this merchant is reputable and can't see anything which would fit the "malicious software" description when we browse through their website.

Might anyone have any idea what might be causing this?

Would the javascript redirect possibly be a cause of the issue? I can't imagine that it would - it's just a line of javascript code which redirects to the merchant's webpage, but I'm at a loss as to what's going on here....

Any help much appreciated.

smallcompany

5:21 am on Jan 10, 2008 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



I only know that more than half of affiliates that are using redirects (in other words, hiding links) are having various foggy reasons for that. One of them is that by hiding their affiliate links they are also hiding their identity. Why? Not everything what they do is right I guess. Also, there could be spammers using similar technique with one or multiple redirects, again for not approvable reason.

What may happen in your case is that Google could not fully determine what you’ve been doing so they have suspended your account. For sure, they never spend too much time in giving explanations or asking questions. Finally, they have (or at least believe to have) enough knowledge about what’s going on in online world, so they don’t really need to ask anything, they just do it.

At the end, why you do not link directly to the merchant you advertise for? The answer may be there.

wildbest

7:31 am on Jan 10, 2008 (gmt 0)

10+ Year Member



Google could not fully determine what you’ve been doing so they have suspended your account.

I can not fully determine what Google is doing with AdWords rankings and minimum bids so I've paused all our AdWords campaigns.

QualityNonsense

9:57 am on Jan 10, 2008 (gmt 0)

10+ Year Member



Excellent reply :)

tomasvdb

12:59 pm on Jan 10, 2008 (gmt 0)

10+ Year Member



if you're using a redirect on your server, i suspect that the display url you use in your adcopy is not the same as the domain the user eventually lands on, which is against Google's editorial policies.

RhinoFish

1:22 pm on Jan 10, 2008 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



take a look at the domains involved in your redirect process, both those you bounce through and the one you land on, here:

siteadvisor.com

to see if it's a domain that's been flagged by macafee's service as being involved with bad downloads.

i doubt this is how G does their policing or algorithmic examination of downloads... and siteadvisor certainly doesn't catch everything... but it sees a lot of funk. when i get a new client or prospect, i check their domains there and if they're flagged for bad downloads, i just take a pass. if they're flagged for bad affiliations with other sites that are flagged, i inspect that and sometimes discuss it with the client to figure out how they can keep their nose clean.

La_Valette

2:05 pm on Jan 10, 2008 (gmt 0)

10+ Year Member



To answer all the above:

1. The destination url is the same as the display url after the redirect runs its course. On occasion we've fallen foul of that rule because of a typo, but when that happened the adgroup was suspended until the ad was revised, not the whole account. This is a claim of malware not of mismatching urls.

2. We are advertising for this merchant on an affiliate basis, i.e. we are using affiliate links. The ad network involved is one of the big three and is definitely reputable - no malware on any of the intermediate sites.

3. Since we're affiliates, we're never able to put the merchant url directly into the destination url box. It would mean we have no way of setting a cookie on the user machine to get credit for our commissions. We have to set the affiliate cookie first, then redirect to the merchant site. If Google considers this "malware", then I guess it's the end of affiliate advertising on Google :(

[edited by: La_Valette at 2:17 pm (utc) on Jan. 10, 2008]

La_Valette

4:36 pm on Jan 10, 2008 (gmt 0)

10+ Year Member



Update: Still no reply from Google on this. Tried calling customer support and the reps clearly wanted to be helpful but they didn't seem like they really understood concepts such as redirection and affiliate links. They kept giving me "I'll pass that on to the technical team".

So now it looks like all we can do is wait for somebody somewhere to act on this. Until then the account remains suspended and business is being lost...

By the way, I tried the siteadvisor thing and both my redirect website as well as the merchant I was ultimately redirecting to passed with flying colors. I have no idea what's going on here...

[edited by: La_Valette at 4:41 pm (utc) on Jan. 10, 2008]

smallcompany

10:26 pm on Jan 10, 2008 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



What I meant about 3 is that you can put your affiliate tracking link into your destination URL as most of people do. Skip your own server. Make that change and let them know. Suspended can be reverted to active. Terminated is really bad.

Despite some comments about unknown, anything unclear to Google will rather be suppressed then let going.

La_Valette

10:44 pm on Jan 10, 2008 (gmt 0)

10+ Year Member



Affiliate links are themselves just redirects. If redirects cause a problem, one more or less redirect won't make any difference. There certainly is no malware on our server - we have never done anything at all even remotely related to malware. A line of javascript code which redirects to another webpage is all there is.

If there was anything wrong with the merchant site we ultimately redirected to, well we deleted their advertisement now to be on the safe side. The site in question was a reputable merchant and I'm sure they weren't doing anything malicious.

I can't understand why an entire account would be suspended over a single adgroup either - there are a couple of hundred unrelated adgroups in this account, and they're all stopped now. Still no news from Google.

[edited by: La_Valette at 10:53 pm (utc) on Jan. 10, 2008]

smallcompany

11:36 pm on Jan 10, 2008 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



I absolutely agree with you in regards of redirects. I just thought you should expel all what you can in order to get an answer what really caused your account suspension.

You say you’ve deleted ads in question. Try giving them another call and explain the situation. It may be that folks behind the front line of customer service are simply too busy (as they are) and that they need more time to get to it.

One thing I’ve experienced in the past is that an account from time to time could be under review. While under review, ads would not be showing and it would be for the whole account. No information would be provided. If you called they would tell you if review was going on.

La_Valette

11:58 pm on Jan 10, 2008 (gmt 0)

10+ Year Member



I replied (three times) to the email they sent notifying me of the suspension, talked to a rep by phone yesterday, and another by online chat.

No reply to the emails. The phone & chat reps said I'd hear back from the technical team once they re-review "your website". I have no idea what they mean by "your website" - if it's my redirect server, that's just a repository for redirect webpages; if it's the merchant website redirected to, that ad has been deleted...

I could communicate all the above to an astute tech guy in less than 2 minutes if there was some direct line of communication to whoever's responsible for the suspension. As things stand I have to go through the general ad support lines (explaining the whole story again each time I call and just being told the tech department will look into it anyway at the end of the conversation) or the email system, and neither of those is producing any results fast.

[edited by: La_Valette at 11:59 pm (utc) on Jan. 10, 2008]

SteveWh

8:42 am on Jan 11, 2008 (gmt 0)

10+ Year Member



La_Valette,

Do a Google site: search for your domain and the other one. Make sure neither is flagged as "This site may harm your computer".

La_Valette

1:46 pm on Jan 11, 2008 (gmt 0)

10+ Year Member



No, neither website is flagged.

I heard from Google support today - they said the tech team is still investigating and the account wouldn't be suspended in the meantime. It's still suspended as of right now though...

La_Valette

4:00 pm on Jan 11, 2008 (gmt 0)

10+ Year Member



Update: this case now seems to be closed. Google says they can "no longer" find malware, and the account is unsuspended. All well and good, although I'd be happier if we could have reached agreement that there was no malware to begin with...

That, and I'm also probably stuck with an extra 100 gray hairs as a result of this incident...

[edited by: La_Valette at 4:00 pm (utc) on Jan. 11, 2008]

SteveWh

5:49 am on Jan 12, 2008 (gmt 0)

10+ Year Member



Starting about Dec 31, there have been some websites flagged for badware because they used a JavaScript called mootools.js. It triggered a false positive virus alert in the CA eTrust scanning engine. At least one site has been flagged by Google within the past few days for having it. Google didn't give their site a "clean" status until they removed it, even though the fact that the mootools alert was a false positive was known days ago.

La_Valette

3:14 pm on Jan 17, 2008 (gmt 0)

10+ Year Member



Well, it's happened again... Account suspended again for an ad for a different merchant. Once again it's not clear whether it's the javascript redirect or the end merchant website that's the problem. The merchant website looks fine. Deleted the adgroup, but now it looks like we have to wait to go through the process again.

Each time this happens, an entire account full of completely unrelated ads for other merchants is being suspended.

What this is really going to force is for each account to contain no more than one merchant website. If you advertise for many merchants as we do, this is going to result in a large difficult-to-manage set of accounts... of course, if it's the javascript redirect causing the issue then all of those accounts will themselves be eventually flagged and suspended too.

[edited by: La_Valette at 3:23 pm (utc) on Jan. 17, 2008]

La_Valette

4:26 am on Jan 18, 2008 (gmt 0)

10+ Year Member



Deleted all ads pointing to the website in question - completely removed the website from the account. To make double sure, pointed the redirect urls at a blank page. Not only is there no "software" there, there is now not even any html code...

Still being told there is "possible malicious software" at the destination urls in the deleted advertisements.

Frankly I'm clueless as to what to do here.