So the question is, why are they doing this? Is it a joe job just to make Google look bad? Seems unlikely since that's a lot of effort just to smear Google's reputation.

So the other possibility is that Google has provided some revenue stream that encourages this kind of hijacking, perhaps they are now paying a bounty to indie affiliates for Google Toolbar installs. If so I hope this convinces them that it's a really bad idea.
Dave Methvin | Homepage | 10.02.05 - 10:29 pm | #

See, the odd thing about this is that theres no apparent gain for google in this - any attempts to reach a bunch of google domains redirect the user to 69.31.81.22. do a google on that IP address, theres a lot of these things floating about already. one on your pcpitstop HJT section in fact!

i think the "antispyware" tool that ends up on an infected PC may be the key to this, but I'm not sure how far Roger has got on that yet. I know that thing is in the Sunbelt database but thats about it at present...
Paperghost | Homepage | 10.02.05 - 10:52 pm | #

So err PG, what exactly do the G-Men look like?
Steven | 10.02.05 - 11:03 pm | #

Like a bunch of guys that have earned my trust through years of spotless behaviour. this is the power of treating your customers AS customers - treat them well and you'll be backed to the hilt. Anyone attempting to use this as an excuse - "it happened to them so it could happen to anyone" - needs to look long and hard at what has happened in the past before they pull that line out.
Paperghost | Homepage | 10.02.05 - 11:20 pm | #

My instant though was that the G-men were some sort of trilby and dark overcoat wearing folk who had no issues with making other folk disapear.

http://cover09.cduniverse.com/Mu...t/31/ 164031.jpg

Wow I was spot on
KiD | Homepage | 10.03.05 - 9:02 am | #

you do realise i'm gonna have to get all men in black on your now, right?

/ pulls out mind eraser raygun thingy
Paperghost | Homepage | 10.03.05 - 9:06 am | #

well given the amount of Scam search sites that have lost out due to Google even after they Changed the Search policy :-(
its really no surprise that someone has set up some sort of Scam/plot/con
the fact that nobody seems to benefit from this is i think not the point getting google a Bad Rep is the point
milligansghost | 10.03.05 - 1:57 pm | #

Oh you said G-Men thought you said errrrrrr ummmmmm never mind
Caz | 10.03.05 - 8:10 pm | #

I guess it is just another way of trying to gain trust of the noob Internetusers who are getting to that site. Google, as already mentioned is a well known and trusted company and seeing such a logo on a site does always seem to work a charm on this kind of user group (the noobs).
I receive daily scam mails with yahoo and other trustworthy companies (lately M$ ones) that look absolutely plausible, even offering valid links to such vendors. Yet, if you where to double click the attached "patch.exe", you d be infected.
As long as there are noobs out there and criminals looking for ways of making money, there will always be such "game" goin. If I recall correcty, you mentioned that the site is to do with a *.biz domain. There are a lot out there, they often dont last long. And I guess Google isnt gonna wait long to take actions...
rgds
Yourhighness | Homepage | 10.03.05 - 8:17 pm | #

Just a possibility, maybe this is a use of Google custom search? That's a feature available to customers of Google AdSense. It lets you put a custom logo at the top of the page, but has a "Powered by Google" that looks a lot like your screen shot.

https://www.google.com/adsense/ws...nse/ws- overview

The benefit to the hijacker is that they would get click credits for the results of the search.
Dave Methvin | Homepage | 10.03.05 - 10:57 pm | #