Yet another strange parasite "hijacking" IBL: warning_this_is_english_domain_to_solv

[Clint1]

Does anyone have any idea WTF this bizarre trailing URL suffix is?

warning_this_is_english_domain_to_solve_this_probl em_submit_site_in_atoall.com.html

Under my G WMT area, I found that as an invalid page on my domain! My domain is the domain prefix and that trailing BS above was appended onto it! So G thinks it's a page on my domain (which will no doubt be considered "nefarious" in some way and which will no doubt eventually result in a penalty on my domain*).

According to G the IBL comes from schonbergfarms.com/default.asp?mc=9&mcn=&st=53028 but naturally the page doesn't exist, at least now it doesn't. Nor is it even showing up on the G index. But check out their homepage.

*Also check out this search.

It's rampant and looks like nothing but trouble.

[Doc]

Well, first the good news, Clint. As you say, it's rampant, so if Google does flag your site in any way, it should be relatively easy to remedy.

That would seem to be the extent of the good news.

I would suggest you immediately check your logs to see if you can detect any spamming originating from your site. I would also immediately report it to G, as a preemptive measure. They may even be able to offer you some additional info.

[Doc]

If you run a WhoIs on SchonbergFarms, you'll see it's been hijacked, Clint. My concern would be that the same could happen to anyone that is foolish enough to enter their URL at AtoAll.

[Clint1]

Originally Posted by Doc

Well, first the good news, Clint. As you say, it's rampant, so if Google does flag your site in any way, it should be relatively easy to remedy.

Thanks for replying. And what would that be?

I would suggest you immediately check your logs to see if you can detect any spamming originating from your site.

When you say "spamming" do you mean like hacks/unauthorized access, that sort of thing? If so, yeah, good idea. If you mean something else like actual spamming; no, my sites have never done anything even remotely resembling that.

I would also immediately report it to G, as a preemptive measure. They may even be able to offer you some additional info.

Who, google?? G offer me "some additional info"??? HA!!! ROTFLMAO!!

I don't know one would "report" anything to G anyway. The only way you can contact the from the WMT area is to falsely self-incriminate and "purger" yourself by checking that box and admitting your site has "violated G guidelines".

[Clint1]

Originally Posted by Doc

If you run a WhoIs on SchonbergFarms, you'll see it's been hijacked, Clint.

It comes as no surprise to me it's in India. But how can you tell it's been hijacked by the whois?

My concern would be that the same could happen to anyone that is foolish enough to enter their URL at AtoAll.

That's for sure! That homepage and entire site has "scammer" written all over it! (And just to be clear, not only have I never submitted any URL's to it, nor would I ever, I never even new it existed until today).

[Doc]

[QUOTE=Clint1;476728]
When you say "spamming" do you mean like hacks/unauthorized access, that sort of thing? If so, yeah, good idea. If you mean something else like actual spamming; no, my sites have never done anything even remotely resembling that.[/QUeOTE]

I'm talking about a takeover, similar to a trojan, that will start sending out spam from your computer, via smtp. Similar instances have arisen with server takeovers. Sometimes they're operating in the background, with no obvious signals that they're doing so, as opposed to a complete hijack.

[Clint1]

Originally Posted by Doc

I'm talking about a takeover, similar to a trojan, that will start sending out spam from your computer, via smtp. Similar instances have arisen with server takeovers. Sometimes they're operating in the background, with no obvious signals that they're doing so, as opposed to a complete hijack.

Since that strange URL suffix is appearing all over the place, I doubt it's my server. But, it could perhaps be all of the websites' servers that are showing those URL suffixes that could be "compromised" in some way. I already checked my File Manager and all looks ok, htaccess file looks ok, but I'll have my hosts run a malware scan. Better to be on the safe side.

I did a 301 redirect from the bogus "hijacked" URL to my homepage.

[Clint1]

I need to make a correction in my first post, but I can no longer edit it. I don't know how the space got in the word "probl em" in that URL suffix, since all I did was copy/paste it here! But it should read:

/warning_this_is_english_domain_to_solve_this_probl em_submit_site_in_atoall.com.html

EDIT: WTF????? It did it again! I KNEW I pasted it correctly! But for some unknown reason the space is still showing up in this post, but it's NOT showing up when I try and edit it!

Therefore if anyone cares to investigate that URL suffix, you'll have to remember "problem" does not have a space in it.

[Doc]

Originally Posted by Clint1

It comes as no surprise to me it's in India. But how can you tell it's been hijacked by the whois?

Here's a thumbnail from the WhoIs page:
My guess would be that their developer is this Sanjeev Kumar Singla in Punjab, and that neither they, nor he, is aware that they've been hijacked.

That's for sure! That homepage and entire site has "scammer" written all over it! (And just to be clear, not only have I never submitted any URL's to it, nor would I ever, I never even new it existed until today).

I didn't figure YOU would!

[Doc]

Clint, if you installed that FF add-on (Quirk SearchStats) I told you about, go to the Schonberg page, and check out the WhoIs on it. I think I may be wrong about it being hijacked, because when you check it out at archive.org, they have no archived pages since 2007. I'd say the page expired, and got snapped up.

[Clint1]

Hijacked or not, something strange and low-down has/is definitely going on with that domain. And it appears it's been going on for a while because everywhere I see that domain it looks the same (same description text). Search for schonbergfarms on these pages:
SEO Directory- Computers
schonbergfarms.com - gudanglagu.com andhravilas.com haaretz.com footlocker.com rds.ca
Etc., etc.

But look at the bottom of this page:
Google Directory - Recreation*>*Pets*>*Dogs*>*Breeds*>*Livestock*Guar dian*Dogs*>*Great*Pyrenees*>*Breeders
And these:
SchonbergFarms.com - AboutUs Wiki Page
schonbergfarms.com - Site Info from Alexa
Looks like that may have been what it used to be. (And deservedly hijacked or lost, looks like one of those freakin' puppy mills!!)

I think this is the most telling of all, the domain was dropped/deleted/expired 4-2009:
Expired and Deleted Domain Names
But picked up again 9-2009:
List of sites launched on 2009-09-27

But it was the parasite website long before 4-2009 because most of the search results are prior to the last year (when I did search for results on the domain in the past year there were few). And, the current whois shows it was "Created" in 8-2009. Now even if that was when it was last renewed, that's a month before the 9-27-2009 date above.

Now that IBL URL I mentioned in my first post that I saw in my WMT area, that was down, is back up again: schonbergfarms[dot]com/default.asp?mc=9&mcn=&st=53028

Luckily they don't have any pages in the G index, and only 10/10 in Y:
https://siteexplorer.search.yahoo.co...ore+URL&fr=sfp
But check the www version search and they have 10/615 (IBL's), and look who the IBL's are from--that parasite games.atoall domain.

From looking at this search, they have been quite busy hijacking people's domains. Most of the results go to VALID pages, which would indicate to me all of those victimized domains were hacked in some way. Otherwise you would get 404's for them.

[Clint1]

And this is also most telling, note that games.atoall.com and schonbergfarms.com have the exact same WhoIs information! Registered by that same parasite, hosted by the same place, and the same name servers and exact same IP address.