Malicious Google Dorks

[JohnC]

inurl:"xplaymovie.php?id="
inurl:"xplay.php?id="
inurl:"xxxplay.php?id="
inurl:"xplays.php?id="
inurl:"xmovie.php?id="
inurl:"xfreeporn.php?id="
intitle:"PornTube: best movies collection."
"This program is potentially dangerous for your system. Trojan-Downloader stealing passwords, credit cards and other personal information from your computer."

[SysAdMini]

http://www.google.com/search?hl=en&as_q=&as_epq=A+REAL+FUCK+DOLL+BEING+GIVEN+8+INCHES+OF+PAIN+&as_oq=&as_eq=&num=100&lr=&as_filetype=&ft=i&as_sitesearch=&as_qdr=all&as_rights=&as_occt=any&cr=&as_nlo=&as_nhi=&safe=images

http://www.google.com/search?hl=en&as_q=&as_epq=nice+bonus+at+the+end.+girl+next+door+with+stripper+sized+cans.+match+made+in+heaven!&as_oq=&as_eq=&num=100&lr=&as_filetype=&ft=i&as_sitesearch=&as_qdr=all&as_rights=&as_occt=any&cr=&as_nlo=&as_nhi=&safe=images

[JohnC]

intitle:"iframe src http://"
intitle:"script src http://"

[ocean]

"My Computer Online Scan"

refined search

similar results

haven't found any executable yet.

[lelenina]

How do you find these malicious searches?  Do you just copy and paste from the actual malicious source?  That's what it looks like for the fake scanner one.

[ocean]

How do you find these malicious searches?  Do you just copy and paste from the actual malicious source?  That's what it looks like for the fake scanner one.

copying the actual malicious source title for example can be a good start.
then you can refine the search by using and combining the advanced/logical operators.

here's a nice cheat sheet: http://www.googleguide.com/advanced_operators_reference.html

ocean