4

As we all know Google detects malware on websites and if found it will add a warning to that site in its search results. It will also add it to a blacklist that Chrome (and other browsers?) use, so if anyone tries to visit the infected site then they'll get a warning.

One of the websites that is operated by the company I work for acts as a directory site, and links to thousands of other sites. The other day we received a message from Google advising that our site was being blacklisted because one of the sites that we linked to was hosting malware. This resulted in anyone visiting our site in Chrome (and maybe other browsers that subscribe to Google's blacklist) receiving a warning, making people think that our site was infected!

We fixed the problem by removing the link to the offending site and validating with Google, which was enough for Google to remove our site from their blacklist.

But the problem remains, what if this happens again in the future? If any site that we link to gets infected then it can impact on our site, which isn't good.

Can anyone confirm for me that this is indeed how Google works? That it blacklists sites that link to infected sites?

I find it hard to believe that this is how it works, as if it is correct then many sites are in danger of being blacklisted. I mean, if I post a public comment on Facebook that links to an infected site then is Google going to blacklist Facebook? If I post a link to an infected site on Stackoverflow then will Stackoverflow be blacklisted? This would make it very easy for people to harm the reputation of sites.

I did some digging and found another directory site that also links to the infected site that affected us, and Google lists them on its "Safe Browsing Site Status" page for the infected site as linking to the infected site, but for some reason it hasn't blacklisted them.

I've suggested adding rel="nofollow" to our external links, as a way of advising Google that we don't endorse the external sites, but I don't know if this is enough to fix the problem.

  • That is not what rel=nofollow is for or what it does so, no, it's not what will fix the problem. – Rob Jun 22 '16 at 2:31
  • You get the malware notice if google detects malware on your site, not sites you link to. However, sometimes you can embed stuff from other sites that gets hacked and then you get the notice too in search results - as it is on your site. For more accurate information. you would be best posting in google's webmaster forum. – user29671 Jun 22 '16 at 8:07
3

We were hit by the same problem as the OP - our site blacklisted so that all Chrome users were getting a big scary red message about "The site ahead contains malware. Attackers currently on [site name] might attempt to install dangerous programmes on your computer that steal or delete your information (for example, photos, passwords, messages and credit cards)." Somewhat damaging to our brand, and you could even say is libellous, because the site ahead (our site) did not contain malware. Ours is a directory site (maybe Google don't like directory sites, as they see themselves as the directory site?), and one of our links (one out of thousands) was to a site hosted on WordPress (you know what is coming...) which of course had been hacked, probably because of some vuln and they had not updated their WordPress.

Sheesh, our whole site blacklisted because we link to a site that has become hacked? And as per the OP, if I include a link in a Facebook post to a site that has become infected, does that mean the whole of Facebook gets infected? No. So why us?

It would be very useful to us to know the magic sauce that Google uses in deciding when to blacklist a site. But I guess that info would be useful to malware spreaders too, so Google don't say.

But what we think (we can't prove it) was triggering Google is that our web links had a bouncer in them - when you click on the link, it is in fact a link to our site, and then that intermediate page 302 Redirects (bounces) the user to the site. The main purpose of our bouncer was, ironically, so that we could redirect them to an interstitial page if there was a problem (e.g. malware) with the intended destination site. Google do something very similar for tracking clicks from Google Ads so that they know who to bill for the clicks.

So, if the OP was using some sort of bouncer or redirector, and that led to a malware-infected site, that may be why Google blacklisted the origin site. We think (guess, suppose) that a regular HREF... link would not attract this sort of unwanted behaviour from Google.

We changed to using the Google Safe Browse API with a much shorter cache time (we were using it previously but only with a daily check, not an every-few-minutes check), so basically every time someone clicks on a link we check with Google Safe Browse API as to whether Google is going to blacklist us for linking to that URL or not. However as of Nov 2019, Google Safe Browse API stops being a free service for commercial users, and you have to move to the pay-for Google Web Risk API if you want to carry on with that sort of trick, which costs money and is more complicated to implement.

1

I am not sure how Google handles this, but maybe pages of your site were redirecting instead of just linking to that other site. I was asked to deal with a similar case on a site recently, and Google had only underlined certain urls that the combination of their url parameters were creating immediate redirections to the infected site.

So this might make a difference, as it behaves similarly to how malicious scripts may work if they exist in your site, to drive visitors to other harmful pages.

As for the nofollow in your links, I doubt it can have any impact in cases of a redirection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.