Forum Moderators: phranque

Message Too Old, No Replies

Sql and Other Domain Attacks, How to Report Offenders?

Domain Attacks for SEO Purposes

         

upalmit

3:05 am on Aug 19, 2008 (gmt 0)

10+ Year Member



I run a website selling widgets, most with very competitive keyword phrases. In the past 4 weeks when I do a back link check on Google, I see a list of websites in the SERPS. The descriptions name my domain, including other domains as well. These SERPS all have the same spammy, incoherent titles, same identical formatting, and layout. It is definitely the work of one attacker. When one gets to the site, a sql command is invoked/ and starts scanning my computer, attempting to download offending files to my computer. Each time I do a back link check, it appears additional offending sites have been added, all spammy as indicated above.

I read on Webmasterworld that this may be the work of sql hackers, listing websites they want to hack in the future....? I have a very good inkling that once one of their sites is shut down, the rest will follow. What are the steps to report to the isp of the offending websites? Any actual URls to find the information are very welcome indeed!

What is the best way to approach this annoying, harmful attack? Wish I could report this attacker to some internet cop. In the meantime, I will go ahead and add these new sites to sites not allowed to visit my computer (please do not visit these attack sites):

[removed details]

Obviously this attempt to dilute the overall strength of my targetted keywords has to stop, and soon--- with a little help from ya'll...Thanks!

[edited by: incrediBILL at 5:43 pm (utc) on Aug. 19, 2008]
[edit reason] specifics removed [/edit]

incrediBILL

5:50 pm on Aug 19, 2008 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



What you're describing isn't a SQL attack, it's called an "Invisible IFrame launcher" which is javascript that attempts to download a file into your computer.

The sites that contain this malware are scraper sites that download content from many sites and scramble it into incoherent pages and generate tons of spam designed to attract people to their sites to be infected and become part of their botnet.

Report these sites to Google in their Webmaster Central for spam reports.

Additionally, if you know where the sites are hosted, writing to the hosting company can get this type of site removed for AUP violations.

The safest way to avoid being infected by these sites is to surf the web with a Firefox add-on called NoScript which pretty much eliminates the threat unless you manually enable scripts to run on those sites.

[edited by: incrediBILL at 5:53 pm (utc) on Aug. 19, 2008]

Demaestro

6:02 pm on Aug 19, 2008 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Most times in this situation writing to the ISP is a waste of time, they are most likely hosting it all themselves or if they do have a third party ISP it is possible they know what is happening on those sites and just doesn't care, and can even be in a country that cares less.

What you are describing sounds like it took someone a lot of time to set up and I doubt they picked a host that would care to hear your complaint.

incrediBILL

6:52 pm on Aug 19, 2008 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Most times in this situation writing to the ISP is a waste of time

That's just bad advice because everyone doing nothing means nothing is ever done.

When my site was under attack by botnets about 80% of the hosts I contacted acted on the problem but most were US and Canadian based that I contacted.

What you are describing sounds like it took someone a lot of time to set up and I doubt they picked a host that would care to hear your complaint.

Actually it takes very little time to create thousands of accounts with the scraper scripts that just dump out junk endlessly in "burn and churn accounts".

The bigger operations that don't tend to go away are hosted in a few countries that are notorious for such things, but if it's not hosted in those countries you have a decent shots at eliminating them.

Anyway, after reporting a few of these things you get a quick idea of which hosts will act and which ones are a waste of time so it's easy enough to focus on those that care in the future and the Google spam report will hopefully stop others from encountering the sites in the first place.

[edited by: incrediBILL at 6:54 pm (utc) on Aug. 19, 2008]

upalmit

12:39 am on Aug 22, 2008 (gmt 0)

10+ Year Member



Thank you so much for your responses- I'm off to do my civic duty!

jake66

6:10 am on Aug 22, 2008 (gmt 0)

10+ Year Member



The past few days I've been getting quite a few SQL injection probes. I'm almost starting to wonder if my site is being circulated on "bad guy" forums. ("Who will be the first to hack this page?" type of thing, I think)
I was going good for a few days with next to no probes - then bam. I get hit with them from all over the place! (Most seem to be situated in the US though)

I report every one of them, except for those that originate from "shady" countries.

Each and every IP earns a spot in my filters, as well. If it's from a country I don't work with, the entire block gets snipped.