Malicious bots
-
I was looking at some recommended keywords and felt sick to my stomach when I saw ilovevitaly.com search shell, resellerclub scam and a few more.
| 2. | | 28(2.29%)ilovevitaly.com search shell | 0.00% | 0(0.00%) | 42.86% | 1.75 | 00:10:13 | 0.00% | 0(0.00%) | $0.00(0.00%) |
| | 3. | resellerclub scam |I believe I have found the multiple IP addresses in which they're coming from and when I say many I mean I found 200 or so. There from different C blocks so they're very difficult to block easily without blocking legitimate traffic.
I'm using a couple of different web application firewalls with the ability to block it pretty much anything. Does anyone have any device on doing this in a manner that might be more efficient than what I'm doing.I definitely do not want Google to think this is something that I did and penalize somebody this would be horrible. The site is going through Sucuri.net to be cleaned of any possible infection right now I do not know how this happened but zero day attacks are unfortunately a very real reality and unfortunately it could've been 1 million things.
Thanks a million guys. I appreciate your help,
Tom -
Hi Jason,
You can request the hosting company you're using block the hostnames below. You can also look for their IP addresses however note this is probably a waste of time because they are so easily changed. This is a tool that you can use if you do want to block by IP
http://www.whatsmyip.org/whois-dns-lookup/
In many cases it shows me the hostname has more than one IP address.
Better to block the host name itself then to deal with the IP's.
Adding a web application firewalls that give you control will make a world of difference to your clients and yourself.
Remember you can check if your site is infected for free by using the tools below. Simply put your domain in and run them to make sure you are not infected.
http://www.unmaskparasites.com/security-report/
https://support.google.com/analytics/answer/2795830?hl=en
I definitely recommend adding one of the WAF's You Can
http://www.incapsula.com/pricing-and-plans.html (free plan will help)
https://sucuri.net/website-firewall/ ( Probably Best Value)
or
http://www.distilnetworks.com/ ( Incredible Bot Protection)
- darodar.com
- bestsub.com
- blackhatworth.com
- buttons-for-website.com
- casinobonustips.com
- cenoval.ru
- civilwartheater.com
- co.lumb.co
- cukwiki.com
- econom.co
- entourank.com
- hulfingtonpost.com
- ilovevitaly.co
- ilovevitaly.com
- make-money-online.7makemoneyonline.com
- priceg.com
- semalt.semalt.com
- seoairport.com
- seokicks.de
- serw.clicksor.com
- similarpages.com
- webstatsdomain.org
- ymlp.co
Here is a list that will allow you to add multiple bad host names to a block list via using a comma in between the host names. I did this just make it easier not to be redundant.
darodar.com,bestsub.com,blackhatworth.com,cenoval.ru,buttons-for-website.com,casinobonustips.com,co.lumb.co,civilwartheater.com,entourank.com,econom.co,cukwiki.com,hulfingtonpost.com,ilovevitaly.co,ilovevitaly.com,make-money-online.7makemoneyonline.com,priceg.com,semalt.semalt.com,seoairport.com,seokicks.de,similarpages.com,serw.clicksor.com,webstatsdomain.org,ymlp.co
Here is a list that will allow you to add multiple bad host names to a block list via using a, in between the host names. I did this just make it easier not to be redundant.
I think you can do some amazing things for very little money with the Sucuri , incapsula (paid) & Distil Networks WAF Allow You to Separate Human, Good Bot, & Bad Bot Page Requests Simply By Changing Your DNS
Why CloudFlare Is Not The Best Fit
https://twitter.com/cloudflare/status/484755523175063552
Tom
-
Update if you use WordPress
-
**Joshua Strebel - Pagely CEO **Today at 02:12
Hey Thomas,
The site is not hacked, if what you are referring to is what is shown here:http://www.incapsula.com/blog/semalt-botnet-spam.html then it is referrer spam. We'll take a look and see what we can do at the network edge. We'll also look over your site as well.
Check the FAQ at https://support.pagely.com for Answers to commonly asked questions.
-
**Joshua Strebel - Pagely CEO **Today at 03:09
This should help in the meantime: https://pagely.com/blog/2015/01/use-spamreferrerblock-fend-spam-referrer-attacks-website/
Check the FAQ at https://support.pagely.com for Answers to commonly asked questions.
-
Blacklist
/!\ Unfortunately, this plugin can't remove ALL spam referral traffic. Some domains are massively hijacking Google Analytics ID to push false traffic directly to Google's servers.
As they do not interfere with your blog or server, the plugin obviously can't do anything against them ; you have to block them in your Analytics account. Click here to view how : https://support.google.com/analytics/answer/2795830?hl=en.Blacklist last download date : 2015-01-27 23:48:35
| Domain | Status |
| .darodar.com | Can't block |
| bestsub.com | Blocked |
| blackhatworth.com | Unknown |
| buttons-for-website.com | Blocked |
| casinobonustips.com | Blocked |
| cenoval.ru | Unknown |
| civilwartheater.com | Blocked |
| co.lumb.co | Blocked |
| cukwiki.com | Blocked |
| econom.co | Blocked |
| entourank.com | Blocked |
| hulfingtonpost.com | Blocked |
| ilovevitaly.co | Blocked |
| ilovevitaly.com | Blocked |
| make-money-online.7makemoneyonline.com | Blocked |
| priceg.com | Unknown |
| semalt.semalt.com | Blocked |
| seoairport.com | Blocked |
| seokicks.de | Blocked |
| serw.clicksor.com | Blocked |
| similarpages.com | Blocked |
| webstatsdomain.org | Blocked |
| ymlp.co |
-
-
I Moved the domain to FireHost I am using their WAF & ADC ($3,672.03) the combination is keeping me safe right now. If you want to be able to block these things
https://www.firehost.com/secure-cloud/application-delivery-controller-web-application-firewall
I strongly recommend using a WAF
https://sucuri.net/website-firewall/ probably the best deal on the planet. ($9-$350)
Sucuri at nine dollars to give you DDos seven protection and three and four with everything the other guys offer on their top-of-the-line models it's pretty easy to make a wise decision and spend nine bucks.
http://www.incapsula.com/ enterprise version or personal version excellent WAF (free to 350)
http://www.distilnetworks.com/ ( awesome bot control) 30 days free $100
or
I'm not going to recommend this tool below because I don't know that it will do the job I know the ones above will. Still at 20 bucks it's worth a look
https://www.cloudflare.com/ ( the free version of cloud flare is hundred percent worthless)
I will update this continuously and can't wait to hear more from other people that are dealing with this.
All the best,
Tom
-
Hi,
I have just been hit by the situation. I will be happy to know what could be the reason and how it could be resolved. Appreciate if someone can help on this!
Thanks
Jason
Got a burning SEO question?
Subscribe to Moz Pro to gain full access to Q&A, answer questions, and ask your own.
Browse Questions
Explore more categories
-
Moz Tools
Chat with the community about the Moz tools.
-
SEO Tactics
Discuss the SEO process with fellow marketers
-
Community
Discuss industry events, jobs, and news!
-
Digital Marketing
Chat about tactics outside of SEO
-
Research & Trends
Dive into research and trends in the search industry.
-
Support
Connect on product support and feature requests.
Related Questions
-
Hiding ad code from bots
Hi. I have a client who is about to deploy ads on their site. To avoid bots clicking on those ads and skewing data, the company would like to prevent any bots from seeing any ads and, of course, that includes Googlebot. This seems like it could be cloaking and I'd rather not have a different version of the sites for bots. However, knowing that this will likely happen, I'm wondering how big of a problem it could be if they do this. This change isn't done to manipulate Googlebot's understanding of the page (ads don't affect rankings, etc.) and it will only be a very minimal impact on the page overall. So, if they go down this road and hide ads from bots, I'm trying to determine how big of a risk this could be. I found some old articles discussing this with some suggesting it was a problem and others saying it might be okay in some cases (links below). But I couldn't find any recent articles about this. Wondering if anybody has seen anything new or has a new perspective to share on this issue? Is it a problem if all bots (including Googlebot) are unable to see ads? https://moz.com/blog/white-hat-cloaking-it-exists-its-permitted-its-useful
White Hat / Black Hat SEO | | Matthew_Edgar
https://www.webmasterworld.com/google/4535445.htm
https://www.youtube.com/watch?v=wBO-1ETf_dY0 -
Malicious links on our site indexed by Google but only visible to bots
We've been suffering from some very nasty black hat seo. In Google's index, our pages show external links to various pharmaceutical websites, but our actual live pages don't show them. It seems as though only certain user-agents see the malicious links. Setting up Screaming Frog SEO crawler using the Googlebot user agent also sees the malicious links. Any idea what could have caused this or how this can be stopped? We scanned all files on our webserver and couldn't find any of malicious links. We've changed our FTP and CMS passwords, is there anything else we can do? Thanks in advance!
White Hat / Black Hat SEO | | SEO-Bas0 -
Negative SEO Click Bot Lowering My CTR?
I am questioning whether one of our competitors is using a click bot to do negative SEO on our CTR for our industry's main term. Is there any way to detect this activity? Background: We've previously been hit by DoS attacks from this competitor, so I'm sure their ethics/morals wouldn't prevent them from doing negative SEO. We sell an insurance product that is only offered through broker networks (insurance agents) not directly by the insurance carriers themselves. However, our suspect competitor (another agency) and insurance carriers are the only ones who rank on the 1st page for our biggest term. I don't think the carrier sites would do very well since they don't even sell the product directly (they have pages w/ info only) Our site and one other agency site pops onto the bottom of page one periodically, only to be bumped back to page 2. I fear they are using a click bot that continuously bounces us out of page 1...then we do well relatively to the other pages on page 2 and naturally earn our way back to page 1, only to be pushed back to page 2 by the negative click seo...is my theory. Is there anything I can do to research whether my theory is right or if I'm just being paranoid?
White Hat / Black Hat SEO | | TheDude0 -
Malicious bot attack?
Several of our websites have experienced a major direct load traffic spike in the last 30 days - roughly 40K new visitors for each site. The bots are emulating IE9 and appear to be hitting our home page and bouncing 100% of the time. The traffic is double our usual volume, or more. Our bounce rates, conversion rate, page views, etc have suffered accordingly. The volume hasn't affected site performance, yet. Since the traffic is direct load, I can't see this being a negative SEO attack. Plus, our search visibility for everything but our brands is abysmal - there aren't any real rankings to tank. Our engineers are saying that the IP addresses are diverse, and they aren't seeing any pattern. I also checked GA for traffic locations, and we aren't seeing anything unusual from overseas.It appears that the attack is US based. Has anyone seen this before?
White Hat / Black Hat SEO | | AMHC0 -
Cloaking/Malicious Code
Does anybody have any experience with software for identifying this sort of thing? I was informed by a team we are working with that our website may have been compromised and I wanted to know what programs people have used to identify cloaking attempts and/or bad code. Thanks everybody!
White Hat / Black Hat SEO | | HashtagHustler0 -
Do searchs bot understand SEF and non SEF url as the same ones ?
I've jsut realized that since almost for ever I use to code first my website using the non sef for internal linkings. It's very convenient as I'm sure that what ever will be the final url the link will always be good. ex: website.com/component1/id=1 Before releasing the website I use extensions to make the url user friendly according the choosen strategy. ex: website.com/component1/id=1 -> website.com/article1.html But I just wondered if google consider both urls as the same ones or if it consider just as a 301 redirection. What do you think is the best to do ?
White Hat / Black Hat SEO | | AymanH0 -
Separate Servers for Humans vs. Bots with Same Content Considered Cloaking?
Hi, We are considering using separate servers for when a Bot vs. a Human lands on our site to prevent overloading our servers. Just wondering if this is considered cloaking if the content remains exactly the same to both the Bot & Human, but on different servers. And if this isn't considered cloaking, will this affect the way our site is crawled? Or hurt rankings? Thanks
White Hat / Black Hat SEO | | Desiree-CP0 -
Correct way to block search bots momentarily... HTTP 503?
Hi, What is the best way to block googlebot etc momentarily? For example, if I am implementing a programming update to our magento ecommerce platform and am unsure of the results and potential layout/ file changes that may impact SEO (Googlebot continuously spiders our site) How can you block the bots for like 30 mins or so? Thanks
White Hat / Black Hat SEO | | bjs20100