[Nottingham] A Google Webmaster Scam?

[ForkBombFluf]

On Wed, 19 Dec 2012, Martin wrote:

> Date: Wed, 19 Dec 2012 17:11:57 +0000
> From: Martin <martin at ml1.co.uk>
> Reply-To: Notts GNU/Linux Users Group <nottingham at mailman.lug.org.uk>
> To: Notts GNU/Linux Users Group <nottingham at mailman.lug.org.uk>
> Subject: Re: [Nottingham] A Google Webmaster Scam?
> 
> On 19/12/12 02:58, Andy White wrote:
>> On Wed, Dec 19, 2012 at 02:36:02AM +0000, Martin wrote:
>>> Folks,
>>>
>>> So we've had our website on Wordpress for a good while now and...
>>>
>>> After upgrading to the latest Wordpress 3.5, Google have dropped this
>>> bombshell and have insisted that I join the "Webmasters Tools" site to
>>> remove their blacklisting from the NLUG site...
>>>
>>> So... Is this for real?!
>>
>> google's apparently objecting to references to http://ozecqnxm.qhigh.com.
>>
>> Poking around in the js, you can see that there are src parameters
>> to http://ozecqnxm.qhigh.com/terafegwqegwg.cgi?5
>
> Indeed so! A quick grep has soon found that. Looks damned suspicious.
>
> Thanks for that. So how did you find that one?

Probably quite easily if anyone else has used Chrome to try an access the 
NLUG web page.  It popped up a giant red warning page telling us all to 
steer well clear of it, and referenced the above URL as the source of 
malware.

(Sorry, I was too lazy to send a screenshot at the time and was pretty 
sure it would result in a rant and an uproar on here eventually anyway.)

;-)