1

After I tried logging to my host's cpanel today, I got the safe browsing warning, about the site "redirecting users to harmful websites".

The cpanel uses an address like this: https://subdomainXX.host.com:8443/

Each subdomainXX is a different VPS providing by the host company.

The address subdomainXX.host.com isn't used for anything else other than the cpanel access (afaik). Indeed, searching for it in Google using the site: operator returns 0 results.

However, searching for site:host.com, returns several infected sites. The other sites are located at different IPs (and I presume different VPS)

This answer seems to suggest that it has happened before, but it's just a guess, with no authoritative documentation.

My question:

Does Google flag all subdomains for malware/phishing if one is infected? (source/documentation if possible) If yes, how can a host be protected from such (mis)use?

2

Does Google flag all subdomains for malware/phishing if one is infected?

Short answer: No

Longer answer: It seems Safe browsing is using some threshold, which is not told. Usually, such flag happens against minor domain owner to force them to fix their website. For bigger web services provider, normally the sub-domain will get away from complete flagging and only specific confirmed bad subdomain(s) will get flagged.

How can a host be protected from such (mis)use

You can't. What you can do is submit a false positive request(make sure you clean them up or use a patched CRM, etc) to safe browsing and wait for them to change the rules to flag bad subdomain explicitly. If you get the domain from others, it is important to inspect the infection track record from virustotal, don't be careless like those character that moved into haunted-house in horror movie. The good news is, unlike horror movie haunted house, safe browsing will remove the flag after it find out bad content has been removed.

Safe Browsing FAQs will give you some idea how GSB flag the web contents. If you want to learn how it is responses to the various scenario, you need to create your own honeypot to gather bad URL and measured it against google safe browsing. Or you can use data from phishing or malicious URL report site like phishtank to "gauge" the google safe browsing response.

  • Thanks. Do you have maybe a source/documentation link for the claims? – pkExec Aug 23 '18 at 14:46
  • @pkExec : nope, but you can gauge it by yourself (using honey pot or various open research feed) – mootmoot Aug 23 '18 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.