1

Unfortunately recently a customer's website has been reported as Suspicious by Google and blacklisted, Google webmaster tools does not show any information on the infection or when it was detected, it just say that there is an unknown malware leading to a huge loss in income.

I've no idea on how to check if there is actually something malicious in the website, the code seems clean and there are no changes in the creation or modification times of the PHP source code files.

I've also done several anti-virus checks with many services included VirusTotal and ESET end point.

Any of you had a similar problem and can point me into the right direction?

Thank you all in advance.

EDIT:

The website has no CMS, is mostly custom PHP with content written in the template files, it had a link to Ammyy software since a lot and has been removed as it may be reported as Trojan from some antivirus softwares, still nothing changed from Google perspective.

EDIT 2:

Google lifted off the ban without explaining nothing actually. The only information we got is that for Google a site that was linked to it had a link, again, to Ammy but it was removed as per 2015-12-18, even if the linked website was not marked as suspicious it required to be linked on Webmaster Tools for "Fetch as Google".

Hope that helps.

|improve this question
  • If you are running a content management system with a database make sure nothing has changed in the database as well. It is possible that someone added hidden links in your content. Or spambots abused the pingback/comment section. – chrki Dec 21 '15 at 13:43
  • Hello, there is no CMS behind, the company does not trust them, I'll add the information on the main post – Matteo Dec 21 '15 at 13:52
2

Online anti-virus options are not complete. You will want to make sure you use a anti-virus on your hard-drive or in the case of a shared web host, it is possible that one site effects another. You would need to talk to your host for a complete check if that is the case. Please understand that there are viruses that will effect a site from outside of the site. As well, you could have a trojan horse that has nothing to do with the website itself and cannot be seen by an online anti-virus. Also, make sure you are not using JavaScript that is causing a real or false hit. This is often missed. An anti-virus run against the hard-drive can determine this.

Various groups report sites to Google. As well, blacklists are checked often by Google.

Make sure that your site is not blacklisted. I like to use http://mxtoolbox.com/blacklists.aspx. There may be better options, however, this one is very good and gives details on how to clear your site from a list if you follow the links.

If your site is clean, then it is a matter of time before Google removes the suspicious tag. This is not a fast process, but also not too bad. If you are sure your site is clean, then all you can do is wait.

|improve this answer
  • We are the hosting service, as I said I checked the whole site with ESET end point, there is no malware, no virus, no worms, no kind of suspicious code (I spent 2 days checking the whole code base) – Matteo Dec 21 '15 at 20:15
  • @Matteo The site is marked suspicious which is a lessor level - which is good. Did you check the blacklists?? Any blacklist should tell you a lot. I do not know ESET. This is the first time I have ever heard of it. As long as you are scanning the HD with rootkit and pass, then you should be okay. We get OPs trusting online AV scans and they do nothing in these cases. As well, referenced JS can be a problem - that has happened before. I get AV hits on JS periodically. If everything is clear, then it is just a false hit and should clear up in time. Nothing you can do to hurry search engines. – closetnoc Dec 21 '15 at 21:35
  • @closentnoc Yes, everything is clear, seems that Google finally lifted off the ban, still the damage is huge an no one is going to refund that to the customer =\ – Matteo Dec 22 '15 at 7:11
  • @Matteo I am glad it all worked out!! Get um drunk and they just might forget about it... ;-) – closetnoc Dec 22 '15 at 14:59
2

There's a high chance someone messed up your server configuration so that users from certain IP addresses are redirected to something other than what is expected.

If your webpage serving software is apache, check all .htaccess files and httpd.conf (or other apache configuration files) to find any unusual entries. Look for some that reference IP addresses and remove anything unusual.

For example. If you see something like:

RewriteCond %{REMOTE_ADDR} ^xxx\.xxx\.xxx\.xxx$ [NC]
RewriteRule ^(.*)$ http://example.com/hackedpage [R=301,L]

or even:

RewriteCond %{REMOTE_ADDR} ^xxx\.xxx\.xxx\.xxx$ [NC]
RewriteRule ^(.*)$ /hackedscript.php [L]

where xxx represents each octet of an IP address, then remove such lines because they are designed to redirect computers having such IP address to a different page.

I won't be able to answer further on the configuration unless I see the configuration file.

Also, you may want to check the system firewall to see if it's redirecting users from certain IP addresses to other pages.

|improve this answer
  • There was no redirect, no malicious code, no .htaccess, no Apache vulnerability (yet discovered at least), nothing wrong with the server security, everything was in check for the customer website – Matteo Dec 22 '15 at 7:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.