tracker2.php Pagejacking via HTTP 302 Redirect Google Bug
Google has a nasty bug these days that allows unsavory webmasters to hijack the content on your site. If your competitor wants to destroy your search engine rankings he only needs to create a simple page that forces a HTTP 302 redirect to your site. Sounds harmless enough right? Well the problem is that Google follows the redirect to the your site but gives the evil redirect site credit for the content.
How Do I Know if a Site is Hijacking My Site?
1. Search in Google for allinurl:www.mysite.com
2. Look for any listings that are not your site but have the exact title as your site.
3. View the Google cache to see if it looks just like your site.
4. Use my HTTP Response Viewer to view all HTTP headers being returned.
If the title is the same, the cache is the same, and a HTTP 302 is being returned, you’ve been page jacked. The most commonly talked about filename associated with this tactic is tracker2.php but many more are popping up. Often times this is accompanied by cloaking tactics to serve up the 302 redirect to Googlebot and a different page to normal visitors. My HTTP Response Viewer fakes the user-agent so that the server thinks it is a visit from googlebot so that you may view HTTP response headers exactly as Google sees them.
The bad site can either return a HTTP 302 redirect header or drop a simple one liner meta-refresh tag.
How Does This Hurt My Site?
Google sees two sites with identical content and one of them gets smacked out of the index. My experience is that is often the original, innocent site.
Some claim that the offensive site actually steals your pagerank in the process but I’m not convinced this is true.
Are All 302 Redirects Malicious?
No. Remember that HTTP 302 is a valid method of reporting that a page has been temporarily redirected to another site. Google is to blame here. I have found that most webmasters are oblivious to the problem it poses. If you find a site that is redirecting to your site and cloaking in the process you can consider it malicious and a swift FedEx from your attorney is in order.
An interesting sidenote is that Business.com recently shot themselves in the foot. They used a 302 redirect to bounce all traffic to business.com to www.business.com. Soon thereafter they suffered the PageRank 0 on the homepage and higher PageRank on internal pages syndrome as well as having their homepage removed from the Google index.
How Can I Stop my Pages from Being Hijacked?
Unfortunately your only course of action is to attempt to get the other site to remove the HTTP 302 redirect. As I said before most webmasters have no idea of the havoc they are wreaking. I have found that a polite yet firm email nearly always results in a swift removal of the redirect and its often followed by a puzzled reply “Whats the problem?”. To make matters worse, it seems that a module for PHPNuke is creating HTTP 302 redirects. (View an example email that has worked extremely well for us)
What is Google Doing About This?
Who knows. They have requested examples of the bug and at the recent Webmasterworld conference they claimed to be working on a resolution but it seems to be taking a long time. Yahoo had the same bug about 10 months ago and they fixed it very quickly.
I have noticed this on several on my websites. I hope Google fixes this quick.
How Can I Stop the Pagejacking?
You can use url rewriting to prevent people doing so.
Emmanuel
Emmanuel: There is no way to stop someone from creating a 302 redirect to a page on your site. How could URL rewriting be a solution?
I’ve also heard of other scripts doing something similar but not sure if it has any adverse affect on the original site.
I’ve found my pages listed in various SERPs but the URL is from the competitors site which redirects to my page. From what I can gather the SE spiders will follow the link to my site but will credit the competitor site with the link (for link popularity or holding PR)
Haven’t found any solution other than as Tony suggests above to contact the webmaster and request the links are removed.
And what about modifying your httpd.conf once you determine the IP address of each hijacker site?
Options blah blah
allow Override all
Order allow, deny
allow from all
deny from 111.111.111.111 And what about modifying your httpd.conf once you determine the IP address of each hijacker site?
Options blah blah
allow Override all
Order allow, deny
allow from all
deny from 111.111.111.111
Culvey,
Your solution doesn’t work. Your solution only blocks the offender from visiting your site. Google will still index the offender’s site as your own.
Tony
You’re right, my brain was fried yesterday. There must be something. Has someone attempted adding an elaborate config using SetEnvIfNoCase Referer commands? If we can detect referers (misspelled of course), then we should be able to block spiders, as they do carry a referer header.
That doesn’t work either because spider’s actually don’t send a referer header. At least the major ones don’t (googlebot, slurp, msnbot).
302 redirects are a major problem and google and msn must take immediate steps to deal with this head on. At least google can stop caching 302 redirects at the moment until they come to a solution.
This is the 301 that I use. Could this have any adverse affect as the 302 did to business.com that you mentioned above.
RewriteEngine On
RewriteCond %{HTTP_HOST} ^itravel\.bz$ [NC]
RewriteRule ^(.*)$ http://www.itravel.bz/$1 [R=301,L]
May be a little late to respond, but there is a fairly easy solution.
Say for, example, a competitor is 302ing your main page, so http://www.competitor-site.com is 302ing http://www.mysite.com
Simply do the following:
Add appropriate meta tags for noindex and nocache to your homepage at http://www.mysite.com
Go to google and fill out the emergency page removal script, and enter in your competitor’s url.
When google goes to remove that page, it will pull your site’s content, find the meta tags, and remove the page.
Then, just remove the page and build a handful of links to get it reinstated.
This has worked wonderfully in past.
Redirection 301: You move Permanently
Redirection 302: You move Temporarily
Meta-Refresh a 0 seconds
All above redirection 302 is creat major problem for Google and MSN. I thing at present google stop catching 302 redirection until it’s find a solution for it.
Jim
TatvaSoft
Temporary redirect is “307″ not 302, 302 is “Found”
Check the site below
http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.3.8
Svet
Svetoslav .. umm .. not exactly:
10.3.3 302 Found
The requested resource resides temporarily under a different URI. Since the redirection might be altered on occasion, the client SHOULD continue to use the Request-URI for future requests. This response is only cacheable if indicated by a Cache-Control or Expires header field.
I accidentally ranked high for ‘maori web designers’ in google. I have since bought a new domain name. However an unrelated site now ranks above me. My content is very similar to what it used to be. I use to own richmedia.co.nz. That now redirects to ezyauctions.co.nz. Can I assume they have my content on their page and are redirecting after google spiders it?