A site with a directory of thousands of links can get blacklisted by Google for one link to a site with malware

Question

As we all know Google detects malware on websites and if found it will add a warning to that site in its search results. It will also add it to a blacklist that Chrome (and other browsers?) use, so if anyone tries to visit the infected site then they'll get a warning.

One of the websites that is operated by the company I work for acts as a directory site, and links to thousands of other sites. The other day we received a message from Google advising that our site was being blacklisted because one of the sites that we linked to was hosting malware. This resulted in anyone visiting our site in Chrome (and maybe other browsers that subscribe to Google's blacklist) receiving a warning, making people think that our site was infected!

We fixed the problem by removing the link to the offending site and validating with Google, which was enough for Google to remove our site from their blacklist.

But the problem remains, what if this happens again in the future? If any site that we link to gets infected then it can impact on our site, which isn't good.

Can anyone confirm for me that this is indeed how Google works? That it blacklists sites that link to infected sites?

I find it hard to believe that this is how it works, as if it is correct then many sites are in danger of being blacklisted. I mean, if I post a public comment on Facebook that links to an infected site then is Google going to blacklist Facebook? If I post a link to an infected site on Stackoverflow then will Stackoverflow be blacklisted? This would make it very easy for people to harm the reputation of sites.

I did some digging and found another directory site that also links to the infected site that affected us, and Google lists them on its "Safe Browsing Site Status" page for the infected site as linking to the infected site, but for some reason it hasn't blacklisted them.

I've suggested adding rel="nofollow" to our external links, as a way of advising Google that we don't endorse the external sites, but I don't know if this is enough to fix the problem.

Answer 1

We were hit by the same problem as the OP - our site blacklisted so that all Chrome users were getting a big scary red message about "The site ahead contains malware. Attackers currently on [site name] might attempt to install dangerous programmes on your computer that steal or delete your information (for example, photos, passwords, messages and credit cards)." Somewhat damaging to our brand, and you could even say is libellous, because the site ahead (our site) did not contain malware. Ours is a directory site (maybe Google don't like directory sites, as they see themselves as the directory site?), and one of our links (one out of thousands) was to a site hosted on WordPress (you know what is coming...) which of course had been hacked, probably because of some vuln and they had not updated their WordPress.

Sheesh, our whole site blacklisted because we link to a site that has become hacked? And as per the OP, if I include a link in a Facebook post to a site that has become infected, does that mean the whole of Facebook gets infected? No. So why us?

It would be very useful to us to know the magic sauce that Google uses in deciding when to blacklist a site. But I guess that info would be useful to malware spreaders too, so Google don't say.

But what we think (we can't prove it) was triggering Google is that our web links had a bouncer in them - when you click on the link, it is in fact a link to our site, and then that intermediate page 302 Redirects (bounces) the user to the site. The main purpose of our bouncer was, ironically, so that we could redirect them to an interstitial page if there was a problem (e.g. malware) with the intended destination site. Google do something very similar for tracking clicks from Google Ads so that they know who to bill for the clicks.

So, if the OP was using some sort of bouncer or redirector, and that led to a malware-infected site, that may be why Google blacklisted the origin site. We think (guess, suppose) that a regular HREF... link would not attract this sort of unwanted behaviour from Google.

We changed to using the Google Safe Browse API with a much shorter cache time (we were using it previously but only with a daily check, not an every-few-minutes check), so basically every time someone clicks on a link we check with Google Safe Browse API as to whether Google is going to blacklist us for linking to that URL or not. However as of Nov 2019, Google Safe Browse API stops being a free service for commercial users, and you have to move to the pay-for Google Web Risk API if you want to carry on with that sort of trick, which costs money and is more complicated to implement.

Answer 2

I am not sure how Google handles this, but maybe pages of your site were redirecting instead of just linking to that other site. I was asked to deal with a similar case on a site recently, and Google had only underlined certain urls that the combination of their url parameters were creating immediate redirections to the infected site.

So this might make a difference, as it behaves similarly to how malicious scripts may work if they exist in your site, to drive visitors to other harmful pages.

As for the nofollow in your links, I doubt it can have any impact in cases of a redirection.