Boned: "Removal from Google's Index‏" email

**senocular** · 11-03-2009, 12:25 PM

So I got this email from google today:

Quote:

Originally Posted by Removal from Google's Index email

Dear site owner or webmaster of senocular.com,

While we were indexing your webpages, we detected that some of your pages were using techniques that are outside our quality guidelines, which can be found here: http://www.google.com/support/webmas...er=35769&hl=en. This appears to be because your site has been modified by a third party. Typically, the offending party gains access to an insecure directory that has open permissions. Many times, they will upload files or modify existing ones, which then show up as spam in our index.

We detected cloaking on your site and suspect this is the cause. For example at http://www.senocular.com/?id=2.82 we found:

Tetrisbuy adobe photoshopbuy cheap adobe photoshopbuy adobe photoshop online

... bla bla bla ...

I checked http://www.senocular.com/?id=2.82. There was nothing there. Then I googled photoshopbuy site:senocular.com. My site does appear, but none of those pages contain the text either. However, if I check the cache I get this:

Quote:

Originally Posted by Google cache

This is Google's cache of http://www.senocular.com/about.php. It is a snapshot of the page as it appeared on Oct 26, 2009 09:25:38 GMT. The current page could have changed in the meantime. Learn more

These search terms are highlighted: senocular com These terms only appear in links pointing to this page: photoshopbuy

Whatup? I can't control that? Am I boned because some spammer moron can't get his links right? ...or is this maybe a way to add page rank to a page by linking to other, legitimate resources?

glosrfc · 11-03-2009, 12:49 PM

Check the Google cache page for http://www.senocular.com/?id=2.82

Cached version

Then check the Text Only Version in the Google header

Text Only Cache

You'll see that the cloaking text is there, along with the link that's intercepting your page hits.

glosrfc · 11-03-2009, 01:18 PM

How it works...and how to detect click-through cloaking:
ftp://ftp.research.microsoft.com/pub/tr/TR-2006-178.pdf

There are things you can do to get round it:
1. Make sure that you don't have a trojan on your PC which is uploading cloaking software to your server
2. Look for suspicious files on your server, particularly redirection scripts
3. Follow the guidelines here http://www.seobook.com/wordpress-blog-hacking-checklist
4. Delete all the files from your server and upload them again

**senocular** · 11-03-2009, 01:40 PM

veird. Thanks! I'll look into that

... ok, I'll have to admit; this one is new to me. And I just happened to walk around all the other signs that pointed to this before posting here. Thanks for setting me straight glosrfc.

glosrfc · 11-03-2009, 01:55 PM

Incidentally, these are the four rogue links:
creditsoft.net - based in Omaha, US - but registered in Queensland, Aus
hfai.net - Minsk, Belarus - but registered in Queensland, Aus
gbah.net - Minsk, Belarus - but registered in Queensland, Aus
bskin.net - 78.159.96.208 - Frankfurt, Germany - but registered in Zypka, Uzbekistan

Which gives you option 5. Contacting their respective ISPs although I wouldn't hold out a great deal of hope there.