I am having problems with malware to my google alerts

[Chris]

Hi,

 all brand new here, first time posting.

I have a website, www.lets-go-to-majorca.com

I have  Google alerts, one of which is 'lets go to majorca'

over the last few days, every Google alert I get for 'lets go to majorca' (my website name) usually reffering to the weather in Majorca, when clicked, goes straight to a web page for a virus check.

First it started with a site called crytheriver.biz I checked this out and apparently it belongs to a company (large one)  called Lewis Global Public relations. This is false, it is owned by Stan M Jorge who aparently has 15 other sites (malware ?). Well I have just gone back to the same e mail and now the landing page is to a site called vrusstatuscheck.com

the google web alert (just as it comes into my e mail is :

Google Web Alert for: lets go to majorca
Majorca (Mallorca) Hotels/Location | Europe Forum | Fodor's Travel ...
lets-go-to-majorca.com/magaluf.html for information for Magaluf and other parts of Majorca. Flights, Hotels etc. It's all there ...


Average weather for majorca
lets-go-to-majorca.com/weather-in-majorca.html. Temperatures Majorca Mallorca Temperature Balearics Weather Climate Majorca Temperatures, Average ...

The top one to Fodors travel is legitimate, it is the lower one (Average weather for Majorca) which is the bad one. In my google alert, it is the words 'Average weather for majorca' which is the blue link  goes straight to vrusstatuscheck.com

I have taken out the www. from the above so as not to get free links to my site.

I am new to this, can anyone help me or tell me how to stop this?

My traffic is really taking a nosedive because of it as my visitors use  'lets go to majorca'  for their web alerts.

Any help would really be appreciated,

Should I contact Google about this so they can check? What is the best procedure to follow?

Ana and Chris.

[RS-232]

Chris,we didn't really understood from the description what's being going over there,
but it sounds like some kind of html injection...maybe you wanna give a try over here for help?
http://www.who-is-who-in-gpt.com/forum/index.php

(What "blue link" and where?Ie.where is the malicious code located?
There is no problem at all posting a direct link to the infected html page's url...)

[Chris]

Hi RS232,

Thanks for replying.

for my site, I have Google alerts set up, one of my alerts is 'lets go to majorca'. Any blog or post using these words gets me an alert sent straight to my e email from google.

I've received two Google alerts for this keyword set over the last two days straight to my e mail address. I check the above alert (and other alerts using majorca related keywords) to post info on blogs etc. to get links to my site, and keep me up to date with the latest Majorca info. on the web.

By the blue link in the Google alert e mail I receive,  I refer to the clickable link which takes you to the URL landing page (for example, my site, www.lets-go-to-majorca.com  is here, a blue link direct to my site).

In my google alert, the blue link is 'Average weather for majorca', but if I or anyone else who has my google alert on their website and click on this link, they do not go to my website, but as follows:

Average weather for majorca <http://dssounds.co.uk/uthankyou/smain.php?id=average%20weather%20for%20majorca> the text, (it doesn't appear in blue here) between the <...> cannot be seen in the google alert, just the link 'Average weather for majorca' but when I click on this I don't go to my weather in Majorca page but go to http://dssounds.co.uk/uthankyou/smain.php?id=average%20weather%20for%20majorca  I hope you follow.

Yesterday the same click on Average weather in majorca took me to http://vrusstatuscheck.com/1/?id=2007&back=%3DjQ43zT1MMQMMI%3DN

and the latest one took me to http://crytheriver.biz/go.php?id=2007&key=cc50a9ed9&p=1

The http://vrusstatuscheck.com/1/?id=2007&back=%3DjQ43zT1MMQMMI%3DN is a particularly hard to close.

What this means is anyone of my thousands of visitors per month who have 'lets go to majorca' for a google alert to keep themselves updated with my new site pages etc. may well probably get a malicious alert, which when they click on it, they will get taken to one of the above sites.

We are just coming now into the tourist season and it seems someone has used my website name so anyone wanting an alert from my site gets a big unpleasant surprise...

...my traffic has dropped drastically because of this.

Other web alerts I have, eg, Mallorca, Majorca, Alcudia, Santa Ponsa etc. are not affected, they are too generic and there are too many websites which use these words. Someone has chosen lets go to majorca because it is my site name and very specific.

What is happening is that someone is posting an alert to my website (hence lets go to majorca gets flagged) anyone receiving the alert will click on the link and get sent to one of the above three sites, not my website, as the alert suggests.
 I hope you understand what I mean.

It is really frustrating, my site is new, it was doing very well for traffic stats, now, its taken a very serious drop.

Please do ask me for more information if the above is not clear. I cannot change my website name, and I hate to think that i will forever have to suffer this malicious type of behaviour using my site name as the target.

I have no idea what to do to stop this,  perhaps anyone may wish to set up a Google alert for 'lets go to majorca' and you will see what i mean when Google  sends you an e mail.

Thank you in advance,

Regards,

Chris
 

[RS-232]

Thanks for the detailed explanation Chris - now I got the concept,as we first thought that the problem was in your website (malicious .js / sql injection or so),
and that's why it confused us about where the problem is...'cause your site appeared totally clean to us ;-)

We're not really in SEO stuff and similar,so we can't really recommend anything specific...
as you already described,it's an abuse of Google's services,in order to promote spam and malware.
Which means that once again,it's probably better to ask the Who-is-who-in-gpt people about it...
they will probably have a few ideas on how to solve and/or where to report it,so that this behavior gets fixed the sooner as possible...
Personally,I would merely try posting it over at Google's groups and webmaster support forums,so that it gets noticed eventually:
http://www.google.com/support/forum/p/Webmasters?hl=en
AskDamageX might also have good suggestions/thoughts to share about it:
http://www.askdamagex.com/

[Chris]

Hi RS232,

Thanks very much for your help.

I have posted on the Google webmasters forum and I have sent a message to the google alerts support at http://www.google.com/support/alerts/bin/request.py

I will see what they say (if anything?) and I will check out the other forums you mentioned.

When anyone is trying to build a website, full of useful content for visitors, these things happen and it's very frustrating. It really is great to know forums like this, with really speedy replies and help, are out there.

I will visit and highly recommend this forum in other forums I frequent

thank you again,

Regards,

Chris.