Google Notifying Hacked Sites

nevetS Evolving Dragon

Messages:: 2,544

Likes Received:: 211

Best Answers:: 0

Trophy Points:: 135

#1

In response to this slashdotting, Matt Cutts put up a post about how google handles hacked sites. Interestingly, they not only put up a message on the webmaster console, they also sent email to several addresses at the domain warning them about the problem.

Reinclusion was quick and easy for this guy, although with all his uninformed public whining and complaining, you might think someone along the line would actually drag their feet with his reinclusion request.

nevetS, Dec 4, 2006 IP

khasmoth likes this.

T0PS3O Feel Good PLC

Messages:: 13,219

Likes Received:: 777

Best Answers:: 0

Trophy Points:: 0

#2

Just got this in my RSS reader, (black or white) hats off to Matt for setting this annoying guy straight.

T0PS3O, Dec 4, 2006 IP

minstrel Illustrious Member

Messages:: 15,082

Likes Received:: 1,243

Best Answers:: 0

Trophy Points:: 480

#3

How Google handles hacked sites
December 4, 2006
by Matt Cutts

First off you should go read Me Against Google. The author is unhappy that talkorigins.org was nowhere to be found in Google for the last 5-6 days. After that post, go read this Slashdot post, entitled Google De-indexes Talk.Origins, Wonâ€™t Say Why. By the time youâ€™re done, your pulse should be pounding. Hell, you should be angry. Damn that evil Google for not communicating with webmasters!! Or as Wesley put it in his blog:

You might think that a company that prides itself upon advanced textual analysis and automated decision-making algorithms might provide helpful warning messages to webmasters concerning problems found in their sites. You would be wrong.

Okay, ready for my side of the story? Hereâ€™s the timeline of how things happened:
- talkorigins.org was hacked on November 18th. I know this because Wesley says so in his blog post.
- By November 27th, Google had detected spammy links and text on talkorigins.org. In case youâ€™re wondering, hereâ€™s what the cracker added:

<snip>

Not pretty stuffâ€“lots of text about rape and animal porn. In case youâ€™re wondering, that JavaScript at the beginning produces the string â€œ<div style=â€™display:noneâ€™>â€, which makes the entire section of spammy junk hidden. So talkorigins.org has these porn words and spammy links, and itâ€™s all hidden via sneaky JavaScript.

We have pretty good reason to believe that this site was hacked, but itâ€™s still causing problems for regular users, so Google has to take action. Hereâ€™s what we do:
- By November 27th, the site was classified as hacked and spammy. We stopped showing it for user queries.
- By November 27th, we started flagging this site as penalized in Googleâ€™s webmaster console. I believe that Google is the only search engine that will confirm to webmasters that their site does have penalties. No, we donâ€™t confirm penalties if we think it might clue in web spammers that theyâ€™ve been caught. But yes, we do try to confirm penalties if we think a site is legitimate or has been hacked. You can read more about how we confirm penalties in this previous post.

I hear a few people ask, â€œItâ€™s nice that I can sign up for Googleâ€™s webmaster console and learn that Google penalized my site. But couldnâ€™t Google have done more?â€ Well, it turns out that we did do more:
- By November 28th, we emailed multiple addresses at talkorigins.org to let them know exactly what happened. According to the records Iâ€™m looking at, we tried to email contact at talkorigins.org, info at talkorigins.org, support at talkorigins.org, and webmaster at talkorigins.org with a timestamp of 2006-11-28 14:24:15. Hereâ€™s an excerpt from the email that we sent:

Dear site owner or webmaster of talkorigins.org,

While we were indexing your webpages, we detected that some of your
pages were using techniques that were outside our quality guidelines,
which can be found here: http://www.google.com/webmasters/guidelines.html
In order to preserve the quality of our search engine, we have
temporarily removed some webpages from our search results. Currently
pages from talkorigins.org are scheduled to be removed for at least 60 days.

Specifically, we detected the following practices on your webpages:

* The following hidden text on talkorigins.org:

e.g.
animal porn, animal sex, beastiality, rape sex, sleeping sex, animal porn, beastiality, dog porn, horse porn, rape sex, sleeping sex, animal porn, animal sex, beastiality, dvd covers, dvd ripper, psp downloads, psp games, psp movies
â€¦

We would prefer to have your pages in Googleâ€™s index. If you wish to be
reincluded, please correct or remove all pages that are outside our
quality guidelines. When you are ready, please visit:

https://www.google.com/webmasters/sitemaps/reinclusion?hl=en

to learn more and request a reinclusion request.

You can read more about how we try to email webmasters about issues on their site in this previous post. According to his post, Wesley did a reinclusion request recently, and Iâ€™ve confirmed that the reinclusion request was approved, so I expect talkorigins.org to be back in Google within 24-48 hours.

But letâ€™s take a step back. This site was hacked and stuffed with a bunch of hidden spammy porn words and links. Google detected the spam in less than 10 days; thatâ€™s faster than the site owner noticed it. We temporarily removed the site from our index so that users wouldnâ€™t get the spammy porn back in response to queries. We made it possible for the webmaster to verify that their site was penalized. Then we emailed the site, with the exact page and the exact text that was causing problems. We provided a link to the correct place for the site owner to request reinclusion. We also made the penalty for a relatively short time (60 days), so that if the webmaster fixed the issue but didnâ€™t contact Google, they would still be fine after a few weeks.

Ultimately, each site owner is responsible for making sure that their site isnâ€™t spammy. If you pick a bad search engine optimizer (SEO) and they make a ton of spammy doorway pages on your domain, Google still needs to take action. Hacked sites are no different: lots of spammy/hacked sites will try to install malware on usersâ€™ computers. If your site is hacked and turns spammy, Google may need to remove your site, but we will also try to alert you via our webmaster console and even by emailing you to let you know what happened. To the best of my knowledge, no other search engine confirms any penalties to sites, nor do they email site owners.

Wesley and anyone else who works on talkorigins.org, Iâ€™m sorry that this was a stressful experience for you. Could Google do a better job? Absolutely, and weâ€™ll keep working on it. For example, maybe we can show a more specific message for hacked sites in the webmaster console. Google could also try to identify better email addresses when writing to site owners. For example, for talkorigins.org, there are email addresses such as â€œarchive@â€ and â€œsubmissions@â€ that we could have used instead that might have reached the right person. Iâ€™m open to other suggestions too. But please give Google a little bit of credit, because I do think weâ€™re doing more to alert webmasters to issues than any other search engine.
Click to expand...

minstrel, Dec 5, 2006 IP

Ohene Guest

Messages:: 474

Likes Received:: 25

Best Answers:: 0

Trophy Points:: 0

#4

never would I think I'd read the terms "animal sex" and "sleeping sex" on Matt Cutts blog.

Ohene, Dec 5, 2006 IP

Log in or Sign up

Google Notifying Hacked Sites

nevetS Evolving Dragon

T0PS3O Feel Good PLC

minstrel Illustrious Member

Ohene Guest

Useful Searches