2

My coworker searched for "cutadapt" at Google Scholar and the top hit was http://journal.embnet.org/index.php/embnetjournal/article/view/200. When he clicked on it, it took him to a site that said something about having a vulnerability and that he should call a certain phone number. It also popped up a box asking for security credentials. He couldn't close the tab, so he restarted the computer to get rid of the page.

I tried the same search and got to the same site. I ended up having to close all of the tabs in my browser to get this security box to disappear.

I wanted to report this, but wanted to be sure I could report exactly how to reproduce the problem. So, I tried the same search again and clicked on the same link with the same address displayed when I hovered over the link. This time, however, I ended up at a completely different, but still obviously incorrect website that seemed malicious to me.

Then I tried a third time and after a long wait, ended up at the right site (or at least it looks like the right site). Now, it only takes me to what looks like the correct site, after a long wait each time.

So, my question is whether this is something that I should report to the web site in question, to my DNS provider, or Google? Or am I even asking the right question(s)?

  • 2
    The owner of the website. Giving malicious pages only in certain cases, instead of always, is a well-known pattern of infected sites/servers to make detection harder. Random example, if the referrer is empty then only show the "good" site => the website owner (who doesn't need to search his own site in Google) may not notice the infection at all, even if he visits the site every day for years. – deviantfan Jun 13 '18 at 19:17
  • Also it's possible that they set a cookie in your browser, so that when you visit the page 2nd time you don't see the fishing page. – Strigo Jun 14 '18 at 13:28
  • @deviantfan Thanks. You’re right. They are working on fixing it. Please post your comment as an answer do I can accept it. – Christopher Bottoms Jun 15 '18 at 14:24
2

The owner of the website.

Showing malicious pages only in certain cases, instead of always, is a well-known pattern of infected sites/servers to make detection harder.
Random example, if the referrer is empty then only show the "good" site => the website owner (who doesn't need to search his own site in Google) may not notice the infection at all, even if he visits the site every day for years.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.