Spam Sites Infesting Google Search Results

The Google Watchdog blog is reporting that "Spam and virus sites infesting the Google SERPs in several categories" and speculates, ...Google's own index has been hacked. The circumvention of a guideline normally picked up by the Googlebot quickly is worrisome. The fact that none of the sites have real content and don't appear to even be hosted anywhere is even more scary. How did millions of sites get indexed if they don't exist?

Comments

Nothing New

[mfh]

For years Yahoo was infested with spammers on their front page, but the fact is -- Google is susceptible to an erosion of moral tenacity, just like any other corporation. Someone from within has given the keys to someone who has paid a lot of money to get them. This isn't a hack job... it's an inside job.

Re:Nothing New

[Nintendork]

Uh-hu. Right. My theory is that Bill Gates, George Bush Sr. and Hitler (Now undead) teamed up to thwart Google. Anyone else have a fun theory to throw out there and get modded up for? Apparently, any theory that's entertaining will do!

Re:Nothing New

[ajs]

Google is susceptible to an erosion of moral tenacity, just like any other corporation. Vague and unsubstantiated claim noted.

Someone from within has given the keys to someone who has paid a lot of money to get them. Why would this kind of left-field claim with absolutely no facts to back it up be modded up? This is pure rumor mongering, and even for Slashdot this is a rather crude bit of slander.

Re:Nothing New

[nuzak]

> My theory is that Bill Gates, George Bush Sr. and Hitler (Now undead) teamed up to thwart Google.

Clearly the Hitler they're in league with is none other than the vile Space Hitler. Someone call in Good Hitler!

Re:Nothing New

[Th3Tron]

Or simply that the larger a company becomes, the more relevant it would be to attack it and expose any weakness. Now that Google pretty much dominates the search engine market, why not flood it with easy spam to get to more people, hell it's probably more simple than spamming e-mail boxes now.

It's the Rand Corporation

[OptimusPaul]

in conjunction with the saucer people under the supervision of the reverse vampires are forcing our parents to go to bed early in a fiendish plot to eliminate the meal of dinner. We're through the looking glass, here, people...

Google index hacked?

[InvisblePinkUnicorn]

Hacking of Google databases might explain why Google Translator used to translate the Russian name for "Ivan the Terrible" as "Abraham Lincoln".

Re:Google index hacked?

[AmIAnAi]

The Google translation service gives the option to suggest a better translation. It's more likely that this service operates automatically and it just takes enough people suggesting the same translation to force the change through.

Might be interesting to try. But I would hope that they have monitoring in place to spot a sudden surge in alternative translations.

Re:Google index hacked?

[rumith]

Besides, it used to translate 'Peter Norton' to Russian as 'Eugene Kaspersky'. :) This trick has been taken down already.

SEOs

[Chilled_Fuser]

  Using one page of information for Google's spider and then using a redirect for a non-spider user. It's an SEO tactic.

Re:SEOs

[glindsey]

Which raises the question: Why not have GoogleBot do a check also as a normal user-agent (IE/Firefox/etc.) and see if the page is significantly different than when it identifies itself? At the very least GoogleBot could check if there are common blacklist words ("viagra" et al) on the website when identifying itself as IE or Firefox.

Re:SEOs

[dschuetz]

I was pretty sure that Google already did some kind of checking for this sort of dodge. It could be that the sites in question have found some way to dodge the dodge -- maybe they figured out when a google revisit (with a different user agent) would occur, or maybe they recognize google IP addresses and always give the scammed page regardless of user agent, or some other similar trick.

That's what makes this scary -- as I said, I thought google was already on the lookout for such scams, and if they're being beat on such a large scale it might mean a major shift in google's strategy is in order...

Re:SEOs

[jmagar.com]

Google does this already, perhaps not with spiders, or in the way you described. But they do seek out and destroy sites that are caught faking keyword densities and other SEO tactics on crawl pages vs human pages.

Re:SEOs

[Tim C]

At the very least GoogleBot could check if there are common blacklist words ("viagra" et al) on the website when identifying itself as IE or Firefox.

So medical supply or information websites shouldn't be indexed by Google?

I know what you're trying to do, but no word is 100% inappropriate. What if someone is actually looking for information on Viagra, or replica Swiss watches, or cheap stocks? What if someone is looking for information on spam?

Check for significant differences in content with different user-agents yes, but banned words? That really doesn't seem like a good idea to me.

Re:SEOs

[IBBoard]

That's not SEO, that's SEM (Search Engine Manipulation - I've patented that version of the acronym). SEO involves optimising a site rather than making it completely different for normal users is manipulation and 'blackhat' tactics. It would be interesting, if a little off-putting, if someone has successfully scammed Google to such a great extent through simple cloaking.

As for the suggestion of a different user agent, I guess it'd be simple enough to either do a reverse lookup and see if it contains "google" or log the range of Google's IPs. I'd have thought Google would have thought of that, but they can't have too many ways that they check with Googlebot not showing up as Googlebot that can't be traced back to them or eventually discovered and made redundant.

Re:SEOs

[suv4x4]

Which raises the question: Why not have GoogleBot do a check also as a normal user-agent (IE/Firefox/etc.) and see if the page is significantly different than when it identifies itself? At the very least GoogleBot could check if there are common blacklist words ("viagra" et al) on the website when identifying itself as IE or Firefox.

It does. It also detects landing pages mentioned above. Apparently it's something more subtle than what one could think of in few mins on Slashdot, and we'll learn soon enough.

Re:SEOs

[Billosaur]

It's more than likely related to IP address than user agent. I used to work in web site metrics, and the number of fouled up user agents and spoofs was always staggering, but IP was a pretty good indicator of who was doing something. No doubt the bad guys have tracked the Google bot's IP over a long period of time and perhaps made some correlations to give them a pretty good idea if the site is being revisited by Google under an assumed user agent. I'm not sure, but it would seem to me that Google would have thought of spoofing it's IPs long ago, to avoid people being able to track them, though I can't say how you'd go about that.

Re:SEOs

[zeromorph]

I've patented that version of the acronym

Don't patented acronyms you insensitive clod!

Re:SEOs

[walt-sjc]

They should. Google already has guidelines that cover this type of behavior. They should enforce them. It's amazing how many sites (including well known sites) violate these guidelines all the time. You would think that Google, with all it's cash (meaning that it can afford to devote the manpower,) would want to improve the quality of their search results, delisting this crap. If they fail to do so, they will start to lose their user base.

Re:SEOs

[colourmyeyes]

Apparently it's something more subtle than what one could think of in few mins on Slashdot

Blasphemy! In my relatively short time lurking on Slashdot, I've seen nearly all the world's problems, including hideously complicated questions of physics, SOLVED in posts no more than a few paragraphs long.

It's amazing, really.

Re:SEOs

[telchine]

Good web sites sometimes include the word viagra. Why should Google block them?

http://news.bbc.co.uk/1/hi/health/medical_notes/104740.stm
http://en.wikipedia.org/wiki/Viagra
http://it.slashdot.org/comments.pl?sid=313253

Re:SEOs

[dargaud]

I suggested better than this a long time ago: use the IE/Firefox rendering engine completely, and feed the resulting image to an OCR program. This way, anything written on white_on_white, font=1, display:none and other tricks get ignored. Then compare the results. Ditch the site if there's too much difference.

Re:SEOs

[Bender0x7D1]

What if someone is looking for information on spam?

Which spam would that be:

• spam: Unsolicited bulk email.
• Spam: A spiced pork and ham product from Hormel.

Re:SEOs

[Shimmer]

Google would have thought of spoofing it's IPs long ago, to avoid people being able to track them, though I can't say how you'd go about that.

Easy: Hire a relatively unknown 3rd party to perform the comparison for you.

Re:SEOs

[Anonymous Coward]

I'm not sure, but it would seem to me that Google would have thought of spoofing it's IPs long ago, to avoid people being able to track them, though I can't say how you'd go about that.

Maybe Google should take a page out of MediaDefender's playbook and rent IP space from organizations that aren't utilizing their allocated blocks.

Re:SEOs

[garett_spencley]

It's a sticky situation / tactic for both Google and it's webmasters.

For example, I have a web site that displays the most recent content for returning visitors and the most popular content for visitors who are visiting my site for the very first time. It's also possible for each user to chose which page to see. This is done to increase productivity on the site and to to increase the likelihood of a new visitor becoming a repeat visitor.

When googlebot visits my page I give it the page with the freshest content. I do this for obvious reasons. I want to google to "see" all of the fresh content that my site is offering. I don't consider this to be "cloaking". I'm not trying to trick Google or do anything malicious. Each and every single user has the option of seeing the freshest page and my page is 'smart' in that it detects if a user has visited my site before and decides what page to present the user with.

Google's guide for webmasters says "before doing something, ask yourself ... would you do this if search engines did not exist, and could you justify what you are doing to a competitor". That's kind of a grey one. Yes, I can easily justify it to a competitor, most of my "competitors" do the similar things. And yes I do offer those two different pages to all of my surfers so that's completely independent of search engines. And I can justify giving the specific page to Googlebot by saying "well, Googlebot is a returning visitor it just doesn't store cookies so if I don't detect Googlebot and give it the fresh content page it will always see the most popular and then it will appear to Googlebot as if my site is rarely to never updated". I just hope that Google sees it the same way.

And so far I've never had any problems with Google blacklisting me or dropping me from the index. So I'm assuming (hoping?) that Google's algorithms are smart enough to distinguish between "completely different / malicious" and "subtly different" and that each case would be passed to a human for manual inspection before dropping from the index or blacklisting would occur. But my point is that there is a lot of grey area. Spammers and Cheaters ruin it for everyone. They ruin it for Google and they ruin it for the honest webmasters who want to get better rankings without spamming or cheating anyone but have to be extremely careful to make sure that other people would agree with their opinion that what they're doing isn't spamming.

Re:SEOs

[Anonymous Coward]

So medical supply or information websites shouldn't be indexed by Google?

Correct. Why should anyone be looking for any medical supplies on *Google*? You should get medical supplies from the local state-licensed pharmacy through consultation with your doctor, not from some fly-by-night operation. There is no reason to do an end run around your doctor for medical care. I don't know of anyone who was able to get "better treatment" by doing something their doctor didn't suggest.

(This is why I hate "talk to your doctor about ..." Big Pharma ads. If you doctor didn't already bring it up, you don't need it.)

Sorry, [/rant].

Re:SEOs

[glindsey]

Yeah, spoofing an IP is easy if you're not looking for a response... but if you're spoofing a request (as a GoogleBot would be doing), where does the response go?

Perhaps Google should create a browser extension -- completely voluntary, of course -- that essentially turns everybody's browsers into a distributed GoogleBot. Of course then they have to deal with malicious nodes poisoning the data, but that could be resolved by having a dozen or so random systems checking the same website and sending their results for comparison.

This way, no spam/scammer could filter by IP, since the IPs would be everywhere.

Re:SEOs

[glindsey]

What if someone is actually looking for information on Viagra, or replica Swiss watches, or cheap stocks? What if someone is looking for information on spam? That's a good point. But perhaps combinations of keywords would work -- it's pretty unlikely that you'd see "viagra" and "mortgage" on the same site, for example. If you partner this with checking for significant user-agent differences it could become a pretty good tool, I think.

Re:SEOs

[glindsey]

Apparently it's something more subtle than what one could think of in few mins on Slashdot, and we'll learn soon enough. Damn. So much for my applying to Google with the bullet point "Solved PageRank spamming problems by posting on Slashdot after thinking for about thirty seconds" on my resumé.

Re:SEOs

[Anonymous Coward]

At the very least GoogleBot could check if there are common blacklist words ("viagra" et al) on the website when identifying itself as IE or Firefox.

Once again we have the amazing phenomenon of a slashdotter instantly solving a problem that the morons who are working on it couldn't. If only the rest of world would get their research from slashdot. All of the world's problems would be solved overnight.

And here the solution is so obvious. Just ban any product that's been mentioned in spam. So simple. Those people at Google are such dopes. How could they not have thought of that??! I mean, what could possibly go wrong?

Re:SEOs

[seanyboy]

I've renamed my user agent to be googlebot.
Hopefully (don't know if it works), sites like this will give me the correctly indexed information.

Re:SEOs

[Pope]

BMW did, and they got delisted from Google: http://news.bbc.co.uk/1/hi/technology/4685750.stm

Re:SEOs

[PhilHibbs]

A legitimate medical supplied web site would contain that information both when crawled by Google and when browsed by Firefox or IE. The GP is suggesting that the site might appear innocuous to Google's crawler but be a spam site to any other visitor. Therefore Google should try faking a browser ID and checking the contents produced. However, the problem with this is that some sites allow Google through but require registration from anyone else.

Re:SEOs

[Anonymous Coward]

Was that supposed to be clever?

Re:SEOs

[nahdude812]

Or set up relay points with different ISP's - buy a rack or a few U's all around the world running nothing but off the shelf proxy software that only proxies for Google's IP addresses.

Re:SEOs

[Anonymous Coward]

Which spam would that be: * spam: Unsolicited bulk email.

The first spam wasn't e-mail, it was on Usenet.

Re:SEOs

[mollymoo]

I'm not sure, but it would seem to me that Google would have thought of spoofing it's IPs long ago, to avoid people being able to track them, though I can't say how you'd go about that.

The fundamental problem with spoofing IPs for this kind of work is that you need to use the right IP to get any data back. You need to have real IPs which are 'disposable'. A botnet, in other words. Google could, if they were evil, create the world's largest botnet by getting JavaScript embedded in search results pages or ads to do the work for them. The Google JavaScript Botnet would make for a pretty potent DOS tool too; making HTTP requests may not be the optimum DOS attack, but when you can generate billions of them and have them coming from all over the internet...

Re:SEOs

[8-bitDesigner]

If you're really keen on hiding anything from GoogleBot, it's not difficult. GoogleBot doesn't understand Javascript, so you can play with all sorts of DOM manipulation to create/hide content. On top of that, I don't know if GoogleBot is yet smart enough to get past the whole "white-text-on-a-white-background" trick used to show GoogleBot one set of content, and the user another.

Re:SEOs

[TeamSPAM]

Context should matter, but that didn't stop Beaver College from changing their name because of porn/child safety filters.

Re:SEOs

[2short]

Those include the word viagra when hit by either GoogleBot or FireFox. The suggestion is to ignore sites that talk about viagra when hit by Firefox, but not when hit by Googlebot.

The correct critique of this suggestion is that Google already does it, so it must not be a solution for the problem at hand.

Re:SEOs

[tknd]

I'm not sure, but it would seem to me that Google would have thought of spoofing it's IPs long ago, to avoid people being able to track them, though I can't say how you'd go about that.

That's so simple!

1. Create free "accelerator" application/browser plug-in to gather web site stats.
2. Distribute application as a beta.
3. ???
4. Profit!

Re:SEOs

[nuzak]

Gary Theurk's spam was email. Usenet didn't even exist then.

Re:SEOs

[nuzak]

It's not that Google can't delist the crap when they run across it. It's just much harder to keep it from getting re-indexed immediately after, unless they fix the fundamental weakness that the spammers are exploiting. And the effects of jiggering the ranking algorithm are *very* widespread, and not taken lightly. Google can and has delisted high-profile offenders before (BMW and Ricoh come to mind) but they don't want to have to fight their own processes in playing whack-a-mole with every chickenbone spammer whose time is far cheaper than Google's

Re:SEOs

[eudaemon]

Because I'm a first responder volunteer looking for the best price on one-use medical items?

Re:SEOs

[Anonymous Coward]

It's not Spam, it's SPAM® luncheon meat.

SPAM® is a registered trademark of Hormel Foods, LLC.

Re:SEOs

[Jeremiah Cornelius]

Academic point.

Gary sent the first unsolicited email in 1978 - to about 400 recipients. It was on a topic that - given the size and constitution of the ArpaNet community - could be reasonably assumed of some interest to the "audience".

The famous Green Card Lottery spam was sent to every available Usenet newsgroup. This was quickly termed "Spam" by the Usenet at large - in reference to its ubiquity, like the Spam in the Python sketch ("Bloody vikings!") This was the first wide-scale, flagrant dismissal of the assumed netiquette and the FAQs for each of the groups about crossposting and relevance.

It was some time after the Usenet spam, that unsolicited bulk mail was called "Spam", too. Thanks, AOL!

Re:SEOs

[barakn]

Results 1 - 10 of about 3,010,000 for viagra mortgage. (0.28 seconds)

Re:SEOs

[Solra Bizna]

The theory is good, but the execution would be horribly complicated, and computationally intensive, and have a very high margin for error. (Computers don't intuit flow as well as humans, for a relatively minor example.)

-:sigma.SB

Re:SEOs

[esaul]

One more eventuality when you might want to completely innocently serve up a different page to a search engine spider is when you have a splash page or an age verification page that is required in some countries if, for example, you sell booze.

Re:SEOs

[Jeremiah Cornelius]

Children is learning.

Re:SEOs

[rthille]

Why not just have the google toolbar compare the page it sees in the end users' browser with that google found when spidering. Very similar to that botnet, but without the nefariousness...

Re:SEOs

[Anonymous Coward]

Spider through Tor. Problem solved.

Re:SEOs

[walt-sjc]

Delisting means removing. It should NOT be re-indexed EVER, until the site owner agrees in writing to stop the bad behavior. It can work off IP addresses. Domain names are free, but IP addresses are MUCH more limited.

Re:SEOs

[glindsey]

And browsing through the top results, I see almost every one is either (a) about spam or (b) a spam page of its own. This seems to strengthen my theory, not weaken it. Now, combine that with checking to see if the page hides details when User-Agent = Googlebot (as the pages talking about spam should remain relatively unchanged), and you have a fairly aggressive filtering system.

Re:SEOs

[pe1chl]

But that would leak pretty quickly, wouldn't it?
Just register a new domain, tell Google to spider it, and watch the logs for a while.
At first there will only be visits from Google. As time passes it will become more difficult, but you just register another domain.

Re:SEOs

[Anonymous Brave Guy]

It's amazing, really.

Not really, you just aren't familiar with the secret techniques we Slashdot vets know and love.

Now, if you'll excuse me, I just have to go back in time and invent the Internet, again...

Re:SEOs

[rs79]

jj@cup.portal.com was the first usenet spam, not cantor and seagull. He asked everybody to send him a dollar to finish university. It was more amusing than annoying. cantor and seagull was more of a declaration of war. Yes I know I'm spelling it incorrectly.

Usenet was so small then that we all knew the "real" jj, at Bell Labs wans't this guy. There wern't a lot of people with the same name on usenet at that time. The only other I can think of was Andrew Tannenbaum.

Re:SEOs

[Jeremiah Cornelius]

Yeah. But this too, pre-dates the "Spam" in-joke and label. ;-)

Re:SEOs

[sjames]

it's pretty unlikely that you'd see "viagra" and "mortgage" on the same site, for example.

Hrmmm, I just saw them together in the same post (and now in 2 posts) in a perfectly legitimate discussion.

I'm sure there are many sites talking about spam that either rant entertainingly or report informatively various email scams complete with quotes.

That's always the danger of absolute blocking based on keywords. No matter how clever your heuristics, some legitimate texts will get blocked.

Re:SEOs

[rs79]

"white_on_white, font=1 "

Google took this out about 3 years ago. A client of mine insisted he wanted this. "No, they'll delist you".

"No they won't and we HAVE to have it".

They removed him from the index for 30 days.

Re:SEOs

[toddestan]

Well, you could always be sneaky and run a search for new domains submitted through MSN and Yahoo, and then only run the followup visit if MSN and Yahoo also know about you.

Re:SEOs

[GWBasic]

I'm not sure, but it would seem to me that Google would have thought of spoofing it's IPs long ago, to avoid people being able to track them, though I can't say how you'd go about that.

Simple: Contract with consumer ISPs like Comcast and Verizon.

Re:SEOs

[rtb61]

The simple solution is manual human review of search results. If google staff do it, it is of course very expensive, so it is very unlikely to happen as better search results will not produce a better profit (the results just have to be somewhat better than the competitors) just a significant increase in cost.

The other of course is a user review of search results by simply blocking unwanted results (google patented this, unfortunately, rumour has it, they pilfered the idea and knowingly perjured themselves), the big catch with this is of course if a major advertiser with google, like ebay, is continually blocked (if I want to buy something from ebay I will look for it on ebay), they wont be happy when their pages are ranked in the hundreds rather than flooding the first few pages.

So at the moment, if those spam sites are full of google addwords generating revenue for the spammer and google, does google really care and if the spam site has nothing else of value, clicking the google add word to get away from it becomes a viable google tactic to generate more google addword revenue.

Consider this, the best search engine will produce the result you want on the first page, you click and you are gone. You have not read any adds, you haven't clicked any add words, you haven't hung around to look at a few more pages of search results. Having a really, actually, good search engine does not suit google's corporate bottom line, of course marketing the opposite of reality does ;).

They are having a sale on tinfoil

[Anonymous Coward]

You should pick some up.

I noticed something this morning

[techpawn]

In my GMail account there where over 60 pieces of spam in a mailbox that has maybe 1 or 2. I wonder if these are related.

Google hacked, sites don't exist, um ...

[icepick72]

Submitter says Google's index has been hacked which could imply the severe case: direct security threat and entry to it, or more likely: managing to get it to index something Google would not want it to index.

Submitter asks: How did millions of sites get indexed if they don't exist?

Okay, I call this an idiot story. Millions of sites come into being and go out of being all the time. What does this statement have to do with anything? It seems like submitter has a lack of understanding how basic Google and the web work, but the story has made it to Slashdot. I think the Slashdot IQ level is dropping because this is a Digg story.

Re:Google hacked, sites don't exist, um ...

[spleen_blender]

I agree completely. Oh have you seen the latest lolcats calendar for 2008? It is so rad you just have to digg it!

Re:Google hacked, sites don't exist, um ...

[Anonymous Coward]

I think the Slashdot IQ level is dropping

Gee yah think? Thank you Captain Obvious.

Re:Google hacked, sites don't exist, um ...

[Clandestine_Blaze]

Millions of sites come into being and go out of being all the time. What does this statement have to do with anything? It seems like submitter has a lack of understanding how basic Google and the web work, but the story has made it to Slashdot. If you had bothered reading the article, you would have seen:

• The .cn sites don't appear to be hosted ANYWHERE. They are simply redirected domain names. How they got ranked in Google in such a short period of time for fairly competitive keywords is a mystery. Google's index even shows legitimate content for the .cn sites.
• It appears that the faked sites are redirecting the Googlebot to a location where content can be indexed, while at the same time recognizing normal users and redirecting them to a site that includes the malware mentioned earlier. This is an obvious violation of Google's guidelines, but the spammers have found ways to circumvent the rule and hide it from the Googlebot.

Yes, millions of sites do come into being all the time. Had Google indexed a site, and had said-site disappeared before the index was updated, you would simply either hit a landing page (if that domain was purchased but not set-up) or you would get an error message

The submitter was referring to instances when a fake redirector is being set-up and tricking the googlebot by sending it to websites with content and keywords while sending normal users to malware-infested sites. This is a completely different situation than "Millions of sites come into being and go out of being all the time." In this case, those sites are still there and are appearing pretty high up in the index, while redirecting unsuspecting users to other websites. They exist in the physical sense, but that's about it.

I think the Slashdot IQ level is dropping because this is a Digg story. Or because the readers simply don't bother to read the articles they comment on any more.

Re:Google hacked, sites don't exist, um ...

[Anonymous Coward]

You're putting a lot of words into submitter's mouth. Your description is good. Submitter's is not.

Re:Google hacked, sites don't exist, um ...

[Clandestine_Blaze]

Good point. I suppose I misinterpreted the parent's response to the article itself and not the summary, which they were commenting on. Whoops. :\

Re:Google hacked, sites don't exist, um ...

[Spy der Mann]

I think the Slashdot IQ level is dropping because this is a Digg story.

[some guy] [scary] At least you should thank it's not a Fark.com story!

Re:Google hacked, sites don't exist, um ...

[Duncan Blackthorne]

Wasn't there a story a while back about how DNS was being hacked? If I am remembering correctly, then couldn't these two things be related?

Re:Google hacked, sites don't exist, um ...

[dropadrop]

Okay, I call this an idiot story. Millions of sites come into being and go out of being all the time. What does this statement have to do with anything? It seems like submitter has a lack of understanding how basic Google and the web work, but the story has made it to Slashdot. I think the Slashdot IQ level is dropping because this is a Digg story.

Maybe Slashdot's index was hacked and this is how the story got through.

Not hosted anywhere?

[Vicegrip]

The article makes the claim that the "hijacked keywords" are going to redirection websites that do not "appear to be hosted anywhere".

That seems a little incredible to me. :)

Invisible, IPless, Chinese web-servers are taking over Google! Personally, I'll just let Google worry about trying to protect its search engines. :)

Re:Not hosted anywhere?

[IBBoard]

Yeah, I think "not hosted anywhere" is somewhat of a simplification for "actually hosted somewhere but never show any content to a normal user because they redirect you to another domain instead". While it might fly for a complete non-techy, I wouldn't have thought /. would have too many people believing in responses from machines that don't exist.

Re:Not hosted anywhere?

[TheRaven64]

Those of us on Internet 3.0, Quantum Edition, have this problem all the time. Quoogle indexes sites without collapsing their wave functions. When you click on a link, the waveform collapses and the server may or may not exist. Web spiders are therefore being replaced by cats.

Re:Not hosted anywhere?

[mgblst]

I know you are trying to be funny, but how can google index a site without collapsing its wave function? That would go against all quantum theory, wouldn't it?

Re:Not hosted anywhere?

[John Hasler]

> I know you are trying to be funny, but how can google index a site without collapsing its
> wave function?

The Googlebot is not an "observer".

> That would go against all quantum theory, wouldn't it?

It would "go against" the Copenhagen interpretation.

Re:Not hosted anywhere?

[rk]

Maybe someone dropped a logic bomb through the trap door.

Maybe it work like this...

[EvilSpudBoy]

Probably the reason they don't have content is the sites respond differently to requests from googles search engine then to requests from users. It would seem that they recognize googles search engine, either from the user agent or from the ip range, and then respond with content. It seems they get the content by proxying US sites. Which I don't think is anything new it's just being done on a larger scale.

When they served the proxied content to google, they could rewrite links on the fly to point to their own domains. They could basically appear like they mirror the whole internet. When a request comes in from a user, since it isn't a google user agent, it would just send it to their trojan infested site.

Re:Maybe it work like this...

[Dachannien]

This should be fairly easy for Google to get around, by re-requesting pages within a short time frame using, say, the IE user-agent string, perhaps from a different IP address. If the pages come up hugely different, toss the page out of the index altogether.

Re:Maybe it work like this...

[EvilSpudBoy]

I imagine they do this. So maybe it is something more sophisticated, but still a variation on the same theme. They could know all of Google's IP ranges or maybe instead of doing that, they know a list of ip's that are definately not google.

Instead of trying to know all of google's ip ranges, and blacklist those, they could just whitelist ip ranges that they know don't belong to google. Because they know they belong to various isp's etc. So the whitelist ip's get the spam page. The unknown ip's get the content pages

Re:Maybe it work like this...

[digitalchinky]

And sadly simplistic in the extreme to counter for any spammer that has at their disposal thousands upon thousands of throw away domain names. Access logs would show in short order which IP's are visiting those sites. Unless google has a huge IP block that nobody knows about, it's not going to work for more than 5 minutes or so.

Re:Maybe it work like this...

[tbannist]

As someone pointed out above, they actually do that, but it seems someone has managed to figure out the alternate IP addresses that they use to verify the search engine results and spoofed those as well.

It could be an ex-employee (either fired, quit, or possibly a contractor) who's sold the information to some black hats, or it could be any number of other things. There's money to be made by subverting Google's index, so you have to know that there are people working on ways to do so all the time.

More interesting

[Finallyjoined!!!]

At least the spam sites are more interesting than pages and pages of price comparison crap :-)

Re:More interesting

[TractorBarry]

Try this

http://www.givemebackmygoogle.com/

It's not perfect as you can't customise the block list but it's a start. Even better make your own version to run on localhost so you can have your own block list etc.

Browser agent string

[140Mandak262Jamuna]

The sites could show one content to Googlebot and another to normal visitors. Google has to test with a different agent string and if the contents differ, they just have to junk the whole domain. I am sure they already do.

Re:Browser agent string

[Anonymous Coward]

What if they show different content to any bot? What if they evaluate the IP to verify it's Google's? Note that a few false positives don't harm the spammer: It means that some people actually get the content they want, instead of the malware. As long as the number of false positives isn't too high, the spammer can just use a combination of heuristics and present indexable content whenever just one indication shows a possible Google source. Say, one test for the Google agent string, one test for reading robots.txt (which should catch all bots, including Google's), and one test for known Google IP. Another possibility would be to show content until indexed by Google (because before that, it's unlikely that any human would access the site anyway), and only then switch the page to malware for normal users. Of course all that can be combined with standard "SEO" techniques.

And those measures are just what immediatly came to my mind. I'm sure a real spammer will use serious thought for designing methods to spam Google, thus possibly coming up with much more effective measures.

Re:Browser agent string

[FooAtWFU]

The sites could show one content to Googlebot and another to normal visitors. Or it could be tricky. Offer the same text/html content, but make part of the content User-Obvious / Bot-Invisible content (images or something thrown together with JavaScript) and downplay or hide the Bot-Obvious content with tricky style sheets or more JavaScript (or just put in a bunch of newlines so it's way down the page). Ultimately it becomes some sort of weird Turing test for Google to be able to detect this sort of stuff.

I call Bullshit!!!

[Jennifer York]

Any evidence to back that up? I seriously doubt that a single individual has the ability to make a change on production boxes without a committee of senior managers approving the change.

Google will adjust, find the method of manipulating the page ranks, and close the hole.

Re:I call Bullshit!!!

[Billosaur]

It may not be a question of a single developer making changes, as much as a single developer (or group of them -- safety in numbers) divulging to certain third parties how the algorithms work in the page ranking system. It's very rare any company gives anyone production access to make changes, but then again I've seen that happen too, where something breaks, they give a developer access to patch it in a hurry before the hew and outcry set in, then forget to revoke his/her access. Of course Google is global, so any change would have to propagate through the system vis source control, so tracking it wouldn't be that hard. I doubt any developer, no matter how nefarious, would take the risk.

Re:I call Bullshit!!!

[zymano]

No it's not. Whenever you ask just a computer program to weed out spam , it will always be outwitted by average human intelligence.

There are websites strictly devoted to google ranking.

Let me add this about Google. The google corporation really isn't 100% innovative. Their search uses common links to rank. This has led to evolution of the spammers. They load their pages with links to spam. So my point to slashdot is......

If google is so damn loaded with money and that their search tech uses common user links, why not pay people/moderators for 'quality' links to information?

Re:I call Bullshit!!!

[Anonymous Brave Guy]

Whenever you ask just a computer program to weed out spam , it will always be outwitted by average human intelligence.

Are you sure? Last time I saw any reasonably scientific study, human error was greater than machine error, at least in terms of false positives that result in lost mail if you give the human a typical scenario and set the anti-spam software to be typically aggressive.

If google is so damn loaded with money and that their search tech uses common user links, why not pay people/moderators for 'quality' links to information?

Because then you'd get the Open Directory Project, which IME is one of the most unpleasant, ungrateful, stuck up, anti-community organisations in the universe.

Re:I call Bullshit!!!

[ehrichweiss]

I don't know about the GP but *I* am certain that a human could more easily tell if they were reading a Markov chained(spam) article versus an article of quality. Computers don't yet have the ability to actually understand if what they're reading is of any quality, humans do.

Re:I call Bullshit!!!

[Metasquares]

They've had people working on their algorithms for quite some time now. I doubt it's in the state where it's something you can just give away all at once... or precisely target, for that matter. It's probably hundreds of thousands of lines of code by now, if not more. They should have systems in place to notify them when that much data is copied at once.

Still waiting for them to allow weighting of search terms, though :)

Re:I call Bullshit!!!

[Anonymous Brave Guy]

Sorry, I should have been clearer about the anecdote. The intended point was that humans relatively frequently misguess whether an e-mail is spam when scanning the typical sender/subject/date/etc. index line, and consequently don't bother opening it and never see the content. How many people really go down their inbox mail by mail, opening and reading every one of the hundreds of spams they might receive in a day to make sure it's spam? And how many mass-delete everything that looks like spam, often without a second glance?

Given arbitrary time, of course humans will be more reliable at judging what they, subjectively, want to read. I'm talking about what tends to happen in reality, where the computer has the advantages of reading at near-instant speeds and never getting bored/tired, and where humans start to skip things or miss lines by mistake after a while.

Re:I call Bullshit!!!

[Anonymous Coward]

Google likes content-free search results. In response to an inquiry about parked-domain garbage, they wrote "Parked domain sites are included in the Google Network because of the value they add to both users and advertisers." Value to users? What value? "With AdSense for domains, parked domain sites now provide users with ads that are relevant to their search." Oh. More ads. Thank you, Google!

I Bet It's a Simpler Explanation

[eldavojohn]

Google is susceptible to an erosion of moral tenacity, just like any other corporation. This would be far more interesting but the sad fact is that it's probably the simplest explanation: spammers are merely more sophisticated. I mean, a while ago a few people teamed up to Google bomb Bush as a "miserable failure" and it worked. They exploited Google's page ranking system. It's pretty easy to exploit because they patented it so you merely need to read the patent. From there you get an idea of how to exploit it.

I imagine that spammers could band together or simply get botnets 'clicking' as independent IP addresses links that boost their page rank. That's how it worked with Bush, they simply linked his homepage as "miserable failure" and suddenly he was the number one result from that query in Google.

I find this more likely an explanation than someone changing the data or values in the database. There's going to be plenty of evidence left in the logs & it's not like nobody's going to notice. This is Google's bread & butter, no amount of money in the world could entice a worker to mess with it. They would have to be exceptionally stupid as the lawsuits that follow would be in the billions.

Re:I Bet It's a Simpler Explanation

[Anonymous Coward]

They would have to be exceptionally stupid as the lawsuits that follow would be in the billions.

Uh...the threat of suing a person for "billions" is pretty fucking toothless if said person doesn't -have- "billions".

Re:I Bet It's a Simpler Explanation

[suv4x4]

I imagine that spammers could band together or simply get botnets 'clicking' as independent IP addresses links that boost their page rank. That's how it worked with Bush, they simply linked his homepage as "miserable failure" and suddenly he was the number one result from that query in Google.

I like your post, but Google can't detect if you "click" a link. It doesn't need botnets to click links from different IP addresses.

It just needs the mere *presence* of those links, with the same text, to the same page. Also the hosting servers of those sites should have different IP-s.

The miserable failure bomb was simply a bunch of bloggers posting a link on their blogs. When GoogleBot came around and found the links, the attack was accomplished.

Re:I Bet It's a Simpler Explanation

[Arthur B.]

Hum, google can and does detect if you click a link, link in the google result page are redirections, look closer.

Re:I Bet It's a Simpler Explanation

[suv4x4]

We're not talking about the results page, but just links. In sites separate from Google.

Re:I Bet It's a Simpler Explanation

[xeoron]

I know Google has pointed me to various spam filled project pages on sourceforge... hopefully Slashdot's parent company is doing something about it.

Re:I Bet It's a Simpler Explanation

[gaspyy]

Please RTFA. The cases mentioned violate the normal guidelines so blatantly that it's hard to imagine how they got through. Anyone who's done a bit of SEO knows that a stunt like this is nearly impossible to pull off.

Re:I Bet It's a Simpler Explanation

[Arthur B.]

Unless the sites happen to have google ads...

Re:I Bet It's a Simpler Explanation

[sconeu]

There's spam/ads on sourceforge? Never seen it... Oh wait... I use AdBlock and FlashBlock.

Re:I Bet It's a Simpler Explanation

[onepoint]

Also one of the best tools to help your ranking is "vote for this page".

I use it, and I think some of the sites I have voted for have improved in ranking.

Re:I Bet It's a Simpler Explanation

[nahdude812]

Or Google Analytics.

Re:I Bet It's a Simpler Explanation

[mcguyver]

FYI, the miserable failure google bomb, and others like it, were killed a few months ago. More spam will invade the system and Google will again figure out a way to combat it. It's an arms race between search engines and spammers that's never going to go away and fortunately Google does a decent job at fixing spam.

Re:I Bet It's a Simpler Explanation

[PingXao]

They recently teamed up with DoubleClick, which is still evil and I don't care who owns it. They also made significant changes to their privacy policy which I don't like. Don't think it was ever covered here at /. which is not surprising given the ownership situation.

Re:I Bet It's a Simpler Explanation

[xeoron]

I use AdBlock and FlashBlock too. The ad spam I am talking about is text based ads that filled the wiki pages and project description pages.

Google used as a spam relay

[P3NIS_CLEAVER]

I was getting pharmaceutical spam that linked to Google; when you clicked the link it relayed you from Google to the pfishing site (No certificate, the site looked completely bogus). I complained about it on their bulletin board, unfortunately Google makes it very difficult to give them feedback on their site.

Re:Google used as a spam relay

[Anonymous Coward]

Because googling for 'google spam report' is difficult?

http://www.google.com/contact/spamreport.html

specific phrases?

[rubberglove]

The story would be more interesting if it included an example hijacked search phrase.
I'd like to check it out myself.

Re:specific phrases?

[zoefff]

google them in news.google.com?

Re:specific phrases?

[wbean]

There's a sample search phrase posted in the comments to the original blog entry. It produced a lot of funny .cn results for me. Here it is:

Bayesian networks and decision graphs Finn rapidshare

Re:specific phrases?

[Anonymous Coward]

I recently had some issues with public folders in Exchange, so I googled using these keywords:
"exchange 5.5" "event 3091"
But it were not those kinds of replication issues I was running into...

Google's Algorithm

[Midnight Thunder]

Two problems I see are:
  - Sites offering one content to Google and another to users. This is indeed something that Google frowns on, but not something that seems to be in place to be tested by the spider.
  - Google's fame comes from their PageRank algorithm and unfortunately people now know how to game the results. If Google were to implement multiple algorithms then users could indicate which search type the wish to use. While it certainly makes thing more complicated for Google, it also makes it more complicated for people trying to game the system, since it is harder to know which algorithm to target.

Re:Google's Algorithm

[Asgerix]

Sites offering one content to Google and another to users. This is indeed something that Google frowns on, but not something that seems to be in place to be tested by the spider.

This is definitely tested by "the spider". This link has already been posted in this thread.

Google's fame comes from their PageRank algorithm and unfortunately people now know how to game the results. If Google were to implement multiple algorithms then users could indicate which search type the wish to use. While it certainly makes thing more complicated for Google, it also makes it more complicated for people trying to game the system, since it is harder to know which algorithm to target.

If Google implemented multiple algorithms, there would still be one best target candidate: The default algorithm.

Wait and see.

[eniac42]

People, its just a blog. If someone has really hacked Google, we will hear soon enough. Otherwise scamming and spoofing the ratings with rubbish sites is a sport thats been going on a long, long time..

Re:Wait and see.

[tbannist]

Actually, it's worse than that. It's a blog that can't provide any actual evidence that anything they claim is true. As far as we know, the entire story is bogus because the blogger has provided nothing to prove that any of his claims are true.

Ironic side link

[IBBoard]

Oh, the irony. We have a /. story talking about spammers exploiting Google, and what side link do we get?

Compare prices on Spam Software

I wonder whether some of the software lets you spam Google's listings easily? Perhaps that's how it was achieved?

Re:Ironic side link

[Blobule]

Why is that irony? It's contextual advertising working as it was designed.

Re:Ironic side link

[IBBoard]

It's an irony because the article is going "oh no, bad spammers" and the advert is going "buy your cheap software and become a big bad spammer here!"

Horrible solution...

[SanityInAnarchy]

TFA suggests that if you want to search actual Chinese sites, you should use google.cn, not google.com.

Erm... no, bad idea. Maybe google.cn won't have the same spam, maybe it will, but it most certainly is censored for other reasons as well. (Unless they've stopped doing this and I've completely missed the news -- there is one tank man on the first page of a google.cn image search for "tiananmen square", compared with almost the entire first page being tank men on google.com.)

And maybe a good suggestion to ignore Chinese sites, for now, but then, why would it work in China, but not here? Seems to me, this tactic would work anywhere, so the only way to be sure you're not infected is to run a secure browser and wait for Googlebot to be updated.

Re:Horrible solution...

[Anonymous Coward]

An image of the tank man got on the results page on google.cn? Looks like someone fell asleep on the job. The person responsible will surely be fired and the image removed very shortly.

Let me tell you how it happened

[unity100]

Spam sites had been indexed before the provider learned about spamming and pulled the plug on the sites.

Re:Let me tell you how it happened

[walt-sjc]

However, anything with a high pagerank (early in the results) should have more scrutiny by google, and be de-listed quickly. Frankly, I find search engine spam worse than email spam. I can easily filter email spam, but search engine spam is MUCH more difficult since you frequently can't tell if a result is spam without visiting the spam site.

Nutcase conspiracy theory adopters web2.0 version

[georgeb]

Quotes:

"Some searches (very specific phrases, and I won't list any of them right now - Google knows which they are) return results with a large number of .cn (Chinese) sites."

"The .cn sites don't appear to be hosted ANYWHERE." (wow!)

"[...] the Word-Confirm on all of their sites, including the one I will have to use to post this, generate a large number of rogue responses, and the HELPDESK facilities with thousands of consoles and employees each all over the planet watch the responses and other traffic characteristics [...]"

How the HECK did _this_ get on /.? It's a new low, I swear.

Wow, you just noticed?

[Anonymous Coward]

I don't know how many times in the last year I've been looking for something, only to be taken to a page where none of the search terms even appeared and there was absolutely no content whatever - only advertising.

However, Google doesn't seem to have suffered as much as the other search engines.

-mcgrew (mcgrew.info)

PS- I was going t use a Google search results page with "mcgrew dead technologies" as an illustration of WTF TFA was talking about, but the top three results all are mine; the first two point to my site, the next points to a K5 article I wrote, the last a K5 comment I made, and I haven't neeb to K5 for the last two years or more! So perhaps this is a case of mountain-molehill?

Re:Wow, you just noticed?

[Anonymous Coward]

The link to your program, Art.zip, is broken. Care to provide an up-to-date one, Mr. McGrew?

Re:Wow, you just noticed?

[VGPowerlord]

One trick that works a lot of the time is to not visit a page that has no link to a Google Cache in the index results.

Most legitimate sites don't put the code to disable Google's Cache option, but most of the spam sites do for some reason...

Cameras

[Renraku]

Everytime I search for digital cameras to do price checks, I get a bunch of fraud/spam sites in the Adwords.

Every fucking time.

I would nail Google to the wall for hosting scam/fraud sites if I could.

Re:Cameras

[kevin.fowler]

The fact is that most US camera sites online are run from NY/NJ and are fly-by-night garbage that thrive on word of mouth and black-hat SEO. They make money. They spend money in adwords. Google likes money.

Re:Cameras

[Renraku]

Its still very illegal. Google probably couldn't be prosecuted, but they should wonder if something is up when people are posting $700 body-only cameras for $200 with a lens and accessories and a free MP3 player. They're always #1 in the adwords.

Re:Cameras

[kevin.fowler]

It certainly is illegal, but this still happens. Even worse, it seems to further this garbage culture on Adwords and cost all of us who participate in it a great deal of money.

If there were any sort of flagging system, all people would do would be to flag competitors. Then we'd be talking about something even worse.

I never use the first few pages of a 'search'

[sjwest]

Its my way of penalising seo'ers. Its worth thinking about

Sure it's not his browser that's porked?

[AskChopper]

I think he needs to run AdAware. Seriously.. I've entered a bunch of the usual suspects into google trying to find these hordes of .cn sites that pop up. No joy yet.. Anyone else found one?

Re:Sure it's not his browser that's porked?

[Anonymous Coward]

I just randomly found some.

Search for "vnc pips e61" without the quotes and check page 7. There are some in other pages, but that one has the most.

Re:Sure it's not his browser that's porked?

[iainl]

By the time you're down in page 7 with that search you seem to have moved past absolutely everything which I'd expect to have a pagerank higher than the femto- range, it seems. The article implies this is stuff dominating the front page, though.

Google is working on this ...

[miller60]

Back in May Google launched on online security blog as part of a broader effort to detect malware sites, presumably to exclude them from the SERP results. They're clearly behind the curve. But this post offers an overview of Google's efforts and ambitions in this area.

Simple way to eliminate pharmaceutical spam

[Alzheimers]

Free universal health care

Re:Simple way to eliminate pharmaceutical spam

[computersareevil]

I presume you will personally pay for it all? TANSTAAFL, idiot.

Re:Simple way to eliminate pharmaceutical spam

[p0tat03]

Funny, I live in Canada and I still get lots of pharma spam. That being said, it's usually in the viagra/cialis category...

Re:Simple way to eliminate pharmaceutical spam

[Anonymous Coward]

Incorrect. I am not sure how much hot air has been blown into the free universal healthcare theme, but:

Do you regularly see news reports where the provision of health insurance funded care does not include provision of a certain drug because it is too expensive? Literally, the insurance company says, "Hey you, this disease you have is really rare, and the drug cocktail that would cure it is quite expensive, so you can't have it, and although we are aware you are stuck with a high level of pain for the rest of your life, we can only say that we empathise"?

Because that is what they actually do in all countries with free and universal healthcare.

I am not talking about "experimental treatments" here (which I would believe US health insurance does not cover either) - in the case of a proven drug, that drug may either be 1) Completely unprovided, i.e. across the board it is not provided to anyone barring special appeal, or 2) Not provided in your specific instance, e.g. if you are old. Old people routinely get the message (or rather, they don't, it's better if they never learn of it, but if they bothered to look it up they would get the message) that drug X which might help their condition is too expensive so it will not be provided to them.

Hence why private health insurance and private clinics still exist (the private clinics often more to do with the 2-year waiting lists on operations) and people go abroad, usually to the US, because their countries have no experience with treatments for certain diseases as they are too rare and thus the alternative is being left to die by the state.

Re:Simple way to eliminate pharmaceutical spam

[ajs318]

We have free universal healthcare in the UK, and it doesn't cut the amount of drug spam. I even get it addressed to .uk e-mail addresses.

Still, you should implement free universal healthcare anyway -- it might help you look more like a civilised country and less like a tin-pot theocratic fascist dictatorship. You could afford it if you spent a bit less on throwing your military weight around, and as a bonus other people might stop hating you.

Re:Simple way to eliminate pharmaceutical spam

[cdrguru]

The elderly would suffer the most from a universal healthcare system in the US. Right now, most healthcare spending is in the last year or so of life. There is also a spike for newborns, mostly preemies and drug-addicted babies.

If we get universal healthcare in the US, we're going to have to have an age-based cutoff like other countries do. Sorry, no treatment if you are over 70 or something like that. I don't see the AARP and similar groups going for that and they are a pretty substantial voting block.

Re:Simple way to eliminate pharmaceutical spam

[Anonymous Coward]

Totally agree. The idiots who believe and buy medical spam will begin pestering real doctors, overworking them even more. Think how long waiting lines will be?

Sheesh, these morons trying to say something cool on slashdot.

Re:Simple way to eliminate pharmaceutical spam

[Anonymous Coward]

The elderly already have government healthcare - it's called medicare. Universal government healthcare would essentially extend that to everybody.

Re:Nutcase conspiracy theory adopters web2.0 versi

[Anonymous Coward]

Well, the last of your quotes isn't from the blog article itself, but from a comment done by an anonymous poster. I'm sure you can find enough examples of much worse crap on Slashdot, especially posted by Anonymous Cowards (myself not included! :-)), thus you shouldn't rate the blog based on that.

Re:Nutcase conspiracy theory adopters web2.0 versi

[Anonymous Coward]

Cool. You hooked up a couple of sentences from the blog entry with a quote from an anonymous response. (yes, the AC who wrote the response is a nutcase)

Way to smear the article!

Where do all the calculators go when they die?

[Scrameustache]

I wouldn't have thought /. would have too many people believing in responses from machines that don't exist. Were getting phantom pings from the ghosts of the still-smoldering servers we slashdotted in our folly!
I'm scared...

Re:Where do all the calculators go when they die?

[Jonathan_S]

| I wouldn't have thought /. would have too many people believing in responses from machines that don't exist.

Were getting phantom pings from the ghosts of the still-smoldering servers we slashdotted in our folly!
I'm scared...

But the good news is that you aren't getting them anymore.

Re:Where do all the calculators go when they die?

[Scrameustache]

Were getting phantom pings from the ghosts of the still-smoldering servers we slashdotted in our folly!
I'm scared... But the good news is that you aren't getting them anymore. You grammar nazis should give us a break on monday mornings : )

Re:Where do all the calculators go when they die?

[Anonymous Coward]

Were getting phantom pings from the G-Hosts of the still-smoldering servers

Is what I read the first time. Spending too much time on /. *mumbles to self*

Calling Bullshit along with this one :Nothing New

[bubblah]

Amazed this ended up on the front page of slashdot, the article has no "facts" there is nothing other than the wink wink nudge nudge believe me bit here. There is nothing in the article to prove the assertion made here. Let alone the whole thing sounds like someone who is having a hard time with gaming the system, and wants to call conspiracy theory.

What hijacked phrases? Not seeing this.

[Animats]

I'm not seeing any of this. I'm trying commonly spammed phrases in Google, and seeing nothing unusual.

• "digital camera" - OK
• "ink cartridge" - OK
• "flat screen TV" - PCworld at the top
• "auto parts" - OK
• "london hotels" - usual results
• "britney spears" - usual results
• "viagra" - Pfizer, Wikipedia, etc.
• "rebelde" (the Mexican telenovela, one of the top ten searches) - normal

Not one .cn site in the top 10 for any of these.

Re:What hijacked phrases? Not seeing this.

[Anonymous Coward]

(It's likely something is inserting "site:*.cn" into the article author's searches...)

Re:What hijacked phrases? Not seeing this.

[Anonymous Coward]

You obviously didn't try "hot wet chinese teens"

Re:What hijacked phrases? Not seeing this.

[TeHCrAzY]

http://www.google.com.au/search?q=Bayesian+networks+and+decision+graphs+Fenn+rapidshare&sourceid=navclient-ff&ie=UTF-8&rlz=1B3GGGL_enAU222AU222/

You don't say?

[acro85]

...is this really news? It's been going on forever, I hope google isn't just now noticing this.

other day

[kurtis25]

The other day I noticed a few spam and splog results creeping into the Google Alerts I have set up. I figured someone had made a change now it sounds like a few other changes have been made. I'm not for internet filtering and throttling (especially by ISPs) but I think we are on the verge of a fundamental change in the internet concept. I think we are going to see a good deal of people tired of having to buy a computer, virus software, spy-ware software, spam protectors, firewalls, and other protective software. I think they are going to start turning to their ISPs for protection. They will want the ISP to par down the internet to safe sites. Some ISPs already do the virus protection thing and cut you off if you have a virus. Now before you freak out on me I don't like this idea but the average user could use someone to protect their internet usage. This consumer protection is normal. Grocery stores don't load the shelf with just any garbage they can find, the choose certain items, especially if you shop at a high end or natural food store, they protect you from trans fats. I think consumers are going to want this type of protection from the internet. I also think this will be a problem for Google. They income is based on the idea that any business, person, scam artist, or thing with internet access can buy ads. I think consumers will start to want these ads to be censored and checked before they see them. I don't want to see an add for some fake camera store when I'm googling cameras.

Re:other day

[verbila]

Good luck - the ISPs are the ones that are *hosting spammers* for profit:

You think Verizon cares about spammers? Think again:

http://www.spamhaus.org/sbl/listings.lasso?isp=verizon.com

You think Comcast cares about spammers? Think again:

http://www.spamhaus.org/sbl/listings.lasso?isp=comcast.net

You think AT&T cares about spammers? Think again:

http://www.spamhaus.org/sbl/listings.lasso?isp=att.net

Large ISPs are too busy making money off spammers and pretending they care about the spam issue to listen to the piddly whines of their customers.

Re:Calling Bullshit along with this one :Nothing N

[onepoint]

well for those of us whom deal with Google as their lively hood ( I currently run PPC campaigns and do some SEO work on my web sites ), this was a problem.

I spent the better part of a afternoon about 2 weeks ago, submitting my searches to Google asking them too look at these sites.

they were under my key word group and it was driving me nut's.

How old is this?

[collinc]

Has anyone actually paid attention to the original post date of TFA?

Thursday, September 20, 2007

Must be nice to hit the jackpot and get some free /. advertising.

google-analytics.com

[TFGeditor]

Has anyone ever looked into how google-analytics.com (formerly Urchin) works? This blogger http://labnol.blogspot.com/2005/11/prevent-google-analytics-from-tracking.html gives a bit of info--and it does not appear to comply with the Google "do no evil" mantra.

Re:google-analytics.com

[ajs318]

For me, it doesn't work; because google-analytics.com is in my /etc/hosts file pointing to 127.0.0.1.

Re:google-analytics.com

[nicolastheadept]

And how is a webmaster simply monitoring what people click on evil? Just because you may be paranoid, it doesn't make Google evil.

Re:google-analytics.com

[causality]

And how is a webmaster simply monitoring what people click on evil? Just because you may be paranoid, it doesn't make Google evil.

A webmaster simply monitoring what I click on, in order to track (at least partially) my browsing habits, for his own gain (ads), with no benefit to me, without my express consent, is the parasitic part. The privacy violation inherent in this sort of tracking and with its increase in prevalance, the idea that it should be acceptable, is the evil part. I have google-analytics.com set to 127.0.0.1 in my /etc/hosts file because this is my way of telling them that my consent was denied. There's nothing necessarily paranoid about it, I just decided that the arrangement wasn't in my best interests.

Re:google-analytics.com

[TooMuchToDo]

A webmaster simply monitoring what I click on, in order to track (at least partially) my browsing habits, for his own gain (ads), with no benefit to me, without my express consent, is the parasitic part.

You're on the site, right? That's your benefit. You don't need to give your "express consent" for him to track what you do on his site. Don't like the terms? Don't go to the site.

Re:google-analytics.com

[IAmGarethAdams]

As a web developer, we put put Google Analytics on all our sites. We don't have any AdSense on any of the sites we build (if any of our clients make money it's through purchases through the site).

We regularly use Analytics to work out how users are navigating our site so we can tweak it to make things easier for them. We could probably write our own bespoke application to do this tracking but it seems pointless while Analytics is a free service.

But it's ok if people like you block analytics at the source, enough people don't have your paranoia that we still get a lot of useful results which help both us, our clients and their users get a better web experience.

Re:google-analytics.com

[Yer Mom]

A webmaster monitoring what I do on his site isn't evil, if he runs the tracking software on his own server and it doesn't send data to third parties.

He doesn't know what other sites I've been to — but Google does. That builds up a huge profile of me over time. You know, the sort of thing we were all yelling about when DoubleClick were doing it? Except DoubleClick doesn't also have our search history, our email history (for Gmail users, anyway) and so on...

Until Google buys DoubleClick and merges the databases, of course.

You want to track who does what on your site? Run your own damn tracking software on your own resources, rather than using our data to pay for it, cheapskate.

Re:google-analytics.com

[causality]

You're on the site, right? That's your benefit. You don't need to give your "express consent" for him to track what you do on his site. Don't like the terms? Don't go to the site.

That's just my point -- what terms? I never saw or agreed to anything before such data were collected on me. If I know that it is there and decide to look for it, I can find such "terms" in the privacy statements of the site or by searching for them, but otherwise this information is collected surreptitiously (it's a tiny piece of javascript embedded in a page; it's not prominent like say a banner ad would be and there is no disclaimer or chance to opt out other than blocking it). You seem to miss my point, which is that my information is mine and is not free for the taking unless I decide that it is, and if your marketing system fails without my unwitting participation, this is a downside to your business model and not a problem with me.

There is absolutely nothing wrong with deciding not to permit some marketer to collect information on me. This is my computer and my 'Net connection and I will decide what traffic is and is not permitted to travel through it; it really is that simple. Tough shit if someone's feeling of entitlement causes them to not like this -- that is not my problem. The Web got along just fine without this sort of marketing for years and is not going to fall apart tomorrow if it were discontinued.

Now, of course any Webmaster is free to deny me access to their site because I won't allow them to collect data on me, and if they did I would respect their decision, as I do not entertain that feeling of entitlement (they don't owe me a listening socket on TCP port 80 any more than I owe them the correct DNS resolution of google-analytics.com). However, in my experience none have ever chosen to do this and there's a good reason for that; it's a bad business decision. If they did deny me access to their site, they would guarantee that I will never shop there, subscribe to their service, or otherwise allow them to earn some money from me (you know, the old-fashioned way, which is by giving me something of value in exchange). Put another way, people who value their privacy still spend money, still buy things, still sign up for services, and companies who respect their customers' wishes can still profit from these events.

Finally, I'd like to point out that the idea that I need a Webmaster to "help" me by trying to figure out for me what I want to buy is for sheep and therefore a bit insulting. I don't buy a company's product because they targeted advertisements at me or because those advertisements had celebrity-of-the-month in them. I buy a company's product because I have determined for myself what I need and have shopped around and decided it was the best deal for my needs. This is the case for any substantial purchase I make. Because of this, I am obviously not the target audience for this kind of advertising and if it has an effect on me at all, it would tend to make me view the company in a negative light (the more pushy the salesman, the more likely it is that I will walk away). Given this, please explain to me exactly what a Web site is missing out on when I decide not to allow them to track my browsing habits.

You really just sound bitter that I expect a company to earn my money by providing something of value to me instead of just allowing them to benefit from my data for free, and that's a shame because this should not be a revolutionary idea. Maybe that threatens your cash cow, but again your faulty business model is not my concern.

Re:google-analytics.com

[Jeremiah Cornelius]

Huh-huh... He said ANAL, Beavis. Huh-huh...

Re:google-analytics.com

[jibjibjib]

A webmaster knowing what you click on is not a privacy violation. You're accessing their server, and of course they know what requests you make to their server. It's like how if you go to the shop and buy some bread, the person who sells you the bread is not violating your privacy by knowing you bought some bread.

Also, you can't say that there's no benefit to you from this monitoring. The ads are what provide the money to allow the website to run.

Re:google-analytics.com

[Jeremiah Cornelius]

If you go to a shop, and on buying bread the shopkeeper:

• Writes down your name and address
  
• Notes the type of bread, and the quantity bought
  
• Reports this information to an agency that aggregates this information from every other shop you visit
  
• Aggregate records are retained into perpetuity

Then, I think we complete your "loaf" story.

Drivers

[headkase]

Try to search for a driver - any driver! I've run into many pages that require 'registration to download' them. And of course registering costs bucks so its a scam.

Search Engine Pessimisation

[ajs318]

Worse, I think, is the act of spamming blogs with links. The theory is that, the more links there are pointing to a website, the more popular it must be; so, by using commonly-available, spam-advertised commercial software to pollute blogs with links unrelated to the subject matter, webmasters imagine they can improve their ranking without paying baksheesh to the search engine companies.

I have had an idea for a hack to WordPress, which will make all links invisible to GoogleBot (and maybe the other search engines too). This should make it pointless for anybody to spam blogs with links to their site, since the links won't be picked up by search engines. In a nod to Mel, I call this "Search Engine Pessimisation".

Re:Search Engine Pessimisation

[Anonymous Coward]

Google already thought of something better

It's even implemented in WordPress already, just turn it on in the options

Re:Search Engine Pessimisation

[ajs318]

I think the existing WordPress feature hides everything from Google, which is not quite what I want. I was going to hide only /<a.*href.*?\/a>/is from search engines; meaning that the substance of the post would still be visible, just not any links it contained.

Re:Search Engine Pessimisation

[Anonymous Coward]

Did you even read the link I posted? Nothing gets hidden from Google, it just tells google to ignore links in the comments rel="nofollow"> (and thus removes any point in link spamming)

Re:Search Engine Pessimisation

[Anonymous Coward]

rel="nofollow" has been implemented by many of the popular blogging and forum tools for a long time now.

meta refresh

[fyoder]

I read the story with interest as something like this happened to me the other day. It didn't even occur to me that Google had been hacked. I figured the original site had been compromised. A hacked web site can be defaced for shits and giggles, obviously, but it could also have a meta refresh tag added to send the browser off to wherever the defacer wants. With the security hole history of most CMS systems out there, I'm surprised that doesn't happen more often.

It looks like Firefox 3 will allow disabling of meta refresh.

The Firefox NoScript extension might be worth considering as well.

lot's of dead .cn domains

[cyberworm]

I was noticing something similar to this earlier. There were quite a few domain names ending in .cn. Seemed mostly like junk domain names, but were very odd for ending in .cn

Imagine that!

[Impy the Impiuos Imp]

> It appears that the faked sites are redirecting the Googlebot to a location where content can
> be indexed, while at the same time recognizing normal users and redirecting them to a site
> that includes the malware mentioned earlier. This is an obvious violation of Google's
> guidelines, but the spammers have found ways to circumvent the rule and hide it from the Googlebot.

Huh. What do you know about that? Who'd've thunk Google's guidline would be disobeyed by spammers, given how well anti-handgun laws make criminals think twice before using a handgun in a crime.

Re:Calling Bullshit along with this one :Nothing N

[Anonymous Coward]

for those of us whom deal with Google I hate to be a grammar nazi, but that was pathetic.

Implies technique for avoiding spam-links:

[QuestionsNotAnswers]

Should I set my user agent to GoogleBot, and perhaps make a plugin that asks for the robots.txt for every page visited?

And if enough people do this, doesn't it help Google too?

What is up with images? They being abused too?

[hurfy]

I just did an image search and forgot a space. I got a lot of bizarre results, a large number of odd ones come from .hu

I searched on Opel Manta but forgot the space. With it i got many matches very little junk in 1st 10 pages. Without a space i got weird results starting on 1st page. What does a car name have to do with a naked chick with a Nokia phone? Mud wrestlers? Homer Simpson? Paris Hilton? Dozens and dozens of unrelated pictures it seems.

Spyware is off ATM so i didn't get any farther than that.

Re:What is up with images? They being abused too?

[Daniel Spiewak]

What does a car name have to do with a naked chick with a Nokia phone? Mud wrestlers? Homer Simpson? Paris Hilton?

...as the number of people searching for "Open Manta" unexpectedly jumps by a factor of 8000x.

Seems China is in need of a re-branding...

[IonOtter]

They should get rid of the Little Red Book and go with this one.

And that dull, red flag is so outdated? Here's a much nicer one.

Re:It was only a matter of time.

[thatskinnyguy]

How is this trolling when it's true? In the history of the internet, the adult film industry has been the front-runners... no matter what it is.

Someones ahead of you...

[QJimbo]

www.qooqle.jp has been around for ages as a Youtube/Google Video downloading site oddly enough. Perhaps they created a wormhole and read your future post? Then again your post didn't exist until somebody read it.

And now I need to go and lie down.

It is NOT an exploit on Google

[DrYak]

I seriously doubt that a single individual has the ability to make a change on production boxes

I, too, think that Google wasn't probably hacked,

For the simple reason that it affects other search engines too :

keywords : "Bayesian networks and decision graphs Finn rapidshare"
(as seen on TFA - someone is looking for pirate copies of a book on rapid share, and misstypes the request, forgetting to use "inurl:" or "site:")

Results :
- You guess it, no copies of this book on Rapidshare.... (it would be a copyright violation, even in Switzerland were the website is hosted.
Besides, according to Swiss copyrights law, you are free, as a student, to go into your faculty's library take Finn's book and photocopy the chapters in Finn's book you need, because the universities are paying whatever is needed to make the books publicly available to their patrons) ...but a lot of chinese spam keyword-overloaded pages :
- Google (.cn only)
- MSN (.cn only)
- Yahoo (not all .cn but some)
- Search.com (not all .cn but some)

All those pages redirect to a page that start downloading an ActiveX installer containing a Trojan (...according to my clamav scan and to http://virusscan.jotti.org/ )

Note that google's pages are subtely different, they feature entries with non-ASCII DNS names.

So two probabilities :
- either google got hacked, and absolutely everybody else are in fact using google's search result instead of having their own database and engine.
- or it's probably another spamdexing attempt, operated by a zombie net.

With a ugly quick script :

for ip in $((for url in `lynx -dump "http://search.live.com/results.aspx?q=Bayesian+networks+and+decision+graphs+Finn+rapidshare&count=1000" | grep -Eo '[[:alnum:].]*\.cn$'`; do ping -c 1 $url; done) | grep -Po '\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}' | sort -u); do echo $ip : ; whois $ip | grep netname; done

we see that all those sites point to a couple of machine of some german hosting company.
So perhaps, their server got hacked and subsequently got involved into some spamdexing scheme.

Some one should call them.

funky "." in domain name.

[nairb774]

Check out the "." before the "cn". A copy paste: "" vs "." I wonder if this has anything to do with it. And that did not work...but the /. preview says &#65294 ; for the unicode value.

This Finding was Validated

[Jeremiah Cornelius]

and commented on by Dvorak. (God, did I just say that he confirmed anything!?!)
http://www.pcmag.com/article2/0,1895,2188281,00.asp

Also, the Reg noticed - after my Slashdot posting, for once - so they are chasing this tail!
http://www.theregister.co.uk/2007/10/01/google_spam_infiltration/

Wheee!

Re:This Finding was Validated

[whitehatlurker]

A slightly more interesting validation is that last night I tried the example search on TFA (bayesian somethings) and got several of the bad ".cn" links on google.com and google.ca. When I tried today, all of these links were gone. Apparently Google is also taking this seriously.

Huh Huh...

[Jeremiah Cornelius]

He said "Abused", Beavis. Self-abuse, get it? Huh, Huh.

domain is NOT .cn

[Anonymous Coward]

- Google (.cn only)

I'm surprised your script grepping '*\.cn$' worked.

Look carefully none of them have the domain '.cn,' they are all 'cn' (ie. there is no true period in the search results prior to cn). It octdumps like so '357 274 216 c n ' rather than ' . c n '

Re:Calling Bullshit along with this one :Nothing N

[Anonymous Coward]

> for those of us whom deal with Google I hate to be a grammar nazi, but that was pathetic.

Yes, I wish people, who have no idea of when 'whom' is correctly used, would just leave well alone. Noone is going to jump down your throat if you use 'who' across the board, but putting on airs and then getting it badly wrong ... it's simply irksome.

Google Desktop

[nobuddy]

I suspect the Google Desktop app. It is installed in the default build on Dells, HP's, and more, and pushed out by everyone and their dog, like Sun Java patches FFS. This app does many useful things, but I suspect that an HTML spam gets "indexed" along with every other http document you view, and makes it's way in to Google's databases. Witht eh sheer volume of spam, the number of clueless users getting new machines or allowing the app to be forced (along with every piece of popup malware that asks) it is polluting their database. That has been my opinion since I looked at the app the first time.

Re:Google Desktop

[Jeremiah Cornelius]

Brilliant deduction of vector! I bet the Google FireFox toolbar is another source....