Wednesday, January 25, 2012

Google Places Has been Hacked by a Loan Spammer

Business Owners and Managers, Check Your Listings!


We're a marketing firm that mainly does financial authoring and publishing. We're small, always have been, and we're OK with the fact that most people don't know who we are, even though we have been around for ten years (and in the industry since the beginning). We don't go looking for chaos. It is the Internet. We trip over it every day!

Earlier this evening, I was checking in on Google's Webmaster Tools to see how quickly we were recovering after nearly getting link-spammed out of existence by a self-proclaimed "SEO expert." He thought it might be a good idea to link to our homepage ~12,500 times, for the same irrelevant phrase, presumably, in order to raise his own ranking. It was evidently a good idea, because it sabotaged us.

He has since removed them, but unfortunately, his links to us have not been delisted from Google yet. Nonetheless, Webmaster Tools still had a nice surprise in store for me. We supposedly now had a first-page ranking for the phrase "personal loans", which was great news. So, I did a search to confirm. Unfortunately, what I found was this:
Example of a Google general search result for "personal loans".
Location setting of: Carmel, Indiana.

As it turns out, an individual in Moscow (a simple whois on the domains below reveals the perpetrator) has figured out how to hack Google Places. Occasionally, you'll read about someone getting their account hacked by a competitor, but this is different. It is considerably more than that. It is a widespread hack, that spans across the United States, not just of a few individuals that were loose with their passwords. This has affected verified listings. Something big has happened here, and I haven't been able to find anything released from Google, or written about it by others in our industry. If someone has already covered this, let me apologize up front. I'm not trying to step on any toes. The Internet is where I make my living, and it is how I provide for my family, so I tend to be a little protective of it. The scam artists need to be called out by our own, or this nonsense with SOPA is only going to be the beginning.

I am on Google+, and included +Matt Cutts on my post, but have not heard anything back yet. I have him in my circles, but he is not in mine. I'm not completely sure of how that network works yet, so I'll just have to wait and see if he weighs in on this. Also, he just posted that he is in India, so he may be a bit busy. If you have connections at Google, please feel free to pass this on, because it needs to be addressed.

Good News: This issue is constrained to just "personal loans" and "payday loans", as far as I can tell so far. There may be other terminology affected, but I wouldn't know where to begin. If you find more issues, please let me know.

Bad News: These may be the only search results affected, but not only financial services pages are being attacked. Ordinary pages are being hijacked, as well. A small consignment shop down the road from our office, had their title, categories and url modified. I have seen other examples, where the phone number was modified, too. The listing below is for a restaurant in Chicago.
Robinson's Ribs
Who Else is Benefitting from This? The links all redirect back to one address, which I am going to assume (without having time to look into it further right now) is an affiliate landing page. The company is: AmeriAdvance. This url is: https://www.ameriadvance .com/?cid=28122 (I added a space before the domain extension in order to keep this from becoming a link in syndication).
You can do these searches in almost any major city and find this hack in play. Here are the cities I did searches in and confirmed the presence of this problem.
  • Indianapolis, IN
  • Carmel, IN
  • Fishers, IN
  • Dayton, OH
  • Boston, MA
  • Washington DC
  • Pittsburgh, PA
  • Palo Alto, CA
  • Santa Clara, CA
  • Sunnyvale, CA
  • Anchorage, AK
  • Honolulu, HI
  • Tampa, Fl
  • Mountain View, CA
These are the domains (identified so far) that are being used to redirect out the Google Places traffic. If you find more, please post them here.
  • f2loans .info
  • igloanspayday .info
  • igpayday .info
  • igpaydayadvance .info
  • jmfinance .info
  • jmloans .info
  • jmpaydayloans .info
  • k3loans .info
  • moneyadvance .info
  • pay-advance .info
  • pay-day-cash-loans .info
  • payday-loan-1hr .info
  • rjloans .info

2 comments:

  1. In addition to the cities that you searched, Bloomington, IN and Chicago, IL bring about the same type of results. All back to AmeriAdvance.

    ReplyDelete
    Replies
    1. Thanks for the info. I will check them out. I only saw the restaurant (above) in Chicago last night. Maybe this is still actively growing.

      Update: I stopped by the consignment shop down the road, Annabelle's, and it has gone out of business. The other listings here, however, appear to be active. One of them is actually a residence. I am currently working on a list, so that I can notify them and hopefully get Google to realize how much of this garbage is in the system.

      Delete