CityWeekly.net is suspicious and possibly malicious, according to Google

Note: this was resolved by CityWeekly within a day of me notifying them.

Sitelock informed me today that one of my websites contained a link to a site that has been blacklisted by Google:

Advisory provided by Google



Opening Link 1 in Chrome, I get this:

If the enlarged, bolded and unambiguous headline doesn't convince you not to proceed, then the image of the escaped con lurking inside a laptop (maybe your laptop???) should do the trick.

Details about problems on this website:

Suspicious

3 malicious pages out of 760 (0.3947%)  and 3 exploits (a pretty broad term) seem like pretty low thresholds to meet to warrant getting blocked by Google.  I guess that's a good thing, but it would be great if Google offered up more details about the kind of exploit detected.  Maybe I've already patched the offending application on my machine and I can safely proceed.

For fun, I visited the two sites that Google says CityWeekly.net infected.  Dlvr.it produces no warning screen from Chrome.  However, Google's report on Dlvr.it:

Not suspicious

Even though there were 1217 malicious pages out of 642702 (0.1894%) and more than 300 exploits, Chrome isn't blocking me from visiting this site like it does with Cityweekly.net/utah.  I'm sure there's an algorithmic reason for it, but that's not the topic at hand.

Citywk.ly forwards to bit.ly and produces no Chrome warning screen.  Google's report on Citywk.ly.  Nothing exciting there.

Returning to cityweekly.net, it appears that their next step would be to have their web admin visit Google's Webmaster Help Center and get things sorted out.  I wonder who their admin is.  Maybe I can send him a friendly email.  Let's try finding him, but not with Chrome since I know I'll get the warning screen.  What about Firefox?

Nope, Firefox doesn't like it either.  Clicking on the button "Why was this page blocked?" leads us to Google Safe Browsing diagnostic page for cityweekly.net/utah.  I've been down that rabbit hole already.

Note:  I only get those two warning screens when I have specific browser security settings enabled.

With Firefox 28:

With Chrome 33:

With those settings disabled the warning screens do not appear in either browser.  I hope they are on by default when the browsers are first installed, but that's an investigation for another day.





Let's have another scanning service weigh in.  Using Sucuri.net's SiteCheck, I get this:

Which is it, Google?  Is cityweekly.net safe or not?  It would be nice if Sucuri provided clickable links to each of those blacklists' reports.

More opinions:

Web Inspector (powered by Comodo) says it's safe.

VirusTotal lists a detection rate of 1/52, detected by Fortinet. Look down that results list and you'll see Quttera list it as a Clean Site.  Search for cityweekly.net/utah directly on Quttera's website and the website appears to be compromised by a malicious javascript file and one other suspicious file. Okay...

StopBadware.com says there used to be a problem, which explains the mixed bag of results I'm finding.

UnmaskParasites.com says it's suspicious but only because it has a 301 redirect. This website is provided by Sucuri.  Their report says Google considers it safe, but clicking the associated link takes us to the Google diagnostic page we saw earlier that says the site is suspicious.

McAfee's SiteAdvisor says it's safe, but when clicking on a link from a recent @CityWeekly tweet, bit.ly says the website has a problem:

The free website malware scanners seem to indicate that the CityWeekly website is not currently harmful.  However, Chrome and Firefox warn the user not to proceed but only when the user has previously asked to be warned about such things.  

What to do?

Ah-ha!  Here's some useful info courtesy of AVG ThreatLabs:

This results page is much better.  Types of malware found is good to know.  Since I have Java set to click-to-run I'll head on over to the site and look up the admin's contact info and send him an email letting him know that Google is possibly throwing up unneeded warnings.  Once their website is removed from Google's blacklist then Sitelock will stop bugging me.


3/23, 7 AM -Emails sent to CityWeekly.

Update 1:  5 minutes after I sent the emails, Chrome stopped throwing up the warning.  Firefox still has their warning and the Google safe browsing report hasn't changed.

Update 2 :  Chrome shows the warning again.  Tweet sent to @CityWeekly.

Conclusion

On 3/23 an editor from CityWeekly emailed me to say that their web host is working on it.  Looks like they notified Google:

Sitelock scanned me again on 3/24 and says I passed. All is well.