2

GoogleSafebrowsing seems to have blacklisted one of my domain names, along with all its subdomains. It is visible on this google search page.

I'm a seasoned linux system administrator, I've checked my server several times, and I didn't find anything suspicious on it.

Of course, I could be wrong, but the point is that Google Webmaster Tools doesn't give me any extra detail: the displayed symptom is "Unknown Malware", and the list of exemple URLs is empty, which gives absolutely no hint at all...

I asked for a review from within Webmaster Tools, which came back negative.

The fact that all the subdomains are affected is rather strange. Some of them are just a static html page, without even any javascript or css.

I made a post on Google's Webmaster Central Help Forum, but didn't get any additional clue. All I got back is a value judgment on the content.

Which solutions do I have to either have more details on why Google did block my whole domain, or to reach a real support at Google?

Improve this question
9
  • Could it possible be due to the fact your running Apaache Httpd 2.2.22 ?
    – LvB
    Jan 14, 2016 at 11:02
  • Also your webpage "yo" is not valid HTML.w3c validator page
    – LvB
    Jan 14, 2016 at 11:06
  • It's not the version of apache: other sites using the same server aren't affected. Concerning the invalid HTML, I don't see why it would be considered harmfull, neither why it would impact other subdomains.
    – Claude Brisson
    Jan 14, 2016 at 11:12
  • the way your incorrect HTML page is constructed can mirror how an exploit abuses a website (e.a. it looks like it has been tampered with).
    – LvB
    Jan 14, 2016 at 12:25
  • One minor detail which may have something to do with it, I noticed that your server is returning an ETag even when instructed not to cache. Maybe not but that definitely shouldn't be so.
    – Jonathan Gray
    Jan 14, 2016 at 16:07

2 Answers 2

Reset to default
6

Solved. One of the subdomains had been hacked and contained several javascript injections.

Some interesting facts:

  1. it's rather surprising that google blacklisted all the other subdomains, I wonder if it's a systematic behavior or not.

  2. the example harmful URLs list given in the WebmasterTools is empty for the other subdomains, but when you ask for a review, which fails, the View Examples button in the mail does list some problematic URLs from the hacked site even if it is not the one you asked the review for.

As a conclusion, while I'm grateful to Google for having detected and filtered the injection, I regret a bit that the blacklisting algorithm exhibits a domain-wide behavior, and that the Webmaster Tools interface is unable to explain that a specific subdomain has been blacklisted because of a problem in another subdomain.

Improve this answer
0

The fact that all the subdomains are affected is rather strange. Some of them are just a static html page, without even any javascript or css.

It is hard to know what really is going on but it might be that your server is hacked like described in Ongoing malware attack targeting Apache hijacks 20,000 sites which would affect all sites. It might also be some injected script inside on of the static Javascript files you serve on the pages. Or it might be something else.

Improve this answer
1
  • 1
    Other domains on the same server aren't affected. I just checked for the Darkleech infection with a script provided by arstechnica, and the system is clean. And precisely, the point is to be able to know why the sites are considered harmful by Google.
    – Claude Brisson
    Jan 14, 2016 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.