The Real Blogger Status

We've been dealing with a minor recent deluge of reports, from blog owners reporting mysterious redirection of their blogs. The original typical report, which started like any report involving a respected Internet service going out of business, was annoying - yet benign. Today, the status changed to malicious. Right now, "w i d g e t s e r v e r . c o m" is redirecting to "l i b o s t u d i o s . com" . Please enter your email address to continue. Many gadgets, long known for redirecting, are again redirecting - recently to "w i d g e t s e r v e r . c o m" - and now to "l i b o s t u d i o s . c o m". As some were diagnosed, a few owners advised that the misbehaving gadget had been installed long ago . We've seen, so far, a few old (not!) friends. M a u k i e , N e o C o u n t e r, and "S u n a n d M o o n P h a s e" can be seen, in some topics . A brief sample of forum topics involving "w i d g e t...

In 2009 , Blogger Help Forum: Get Help with an Issue had various reports about blogs mysteriously redirecting to " blogoholic.info ". Later that year, and into 2010 , we saw new reports mentioning " smashingfeeds.com ", then " sendptp.com ". When we investigated the redirections, we found people with blogs that used a picturesque animated decoration known as "falling snow" - and later, as Valentines Day 2010 approached, "falling hearts". The victimised blog owners, too frequently, admitted to having installed various gadgets provided by helpful non Blogger website owners. Diagnosing the problem, however, was frequently obscured by the claims. But I installed that gadget months ago! In some cases, diagnosed in December 2009 - February 2010, the misbehaving gadgets had been installed as far back as Summer of 2009.

This week, we're seeing the anxious query, in Blogger Help Forum: Get Help with an Issue . Is my blog for sale? I try to view my blog, and I see This Domain Is for Sale Have I lost my blog? Fortunately, in most cases, the answer is "No, your blog is not for sale." - and "No, you have not lost your blog!". In mid 2014, NeoWorx, the publisher of popular gadgets like NeoCounter, closed up shop. Back end code for their gadgets, installed on thousands of blogs and websites, had been served from their private libraries. Having closed their domains, the gadgets stopped working.

This week, we're seeing a new stream of problem reports, from blog owners whose blogs are, once again, mysteriously redirecting their readers to unknown destinations . When I open my blog, it automatically directs to another search engine display. This appears to be yet one more gadget, willingly installed by many Blogger blog owners, which is now redirecting uninterested viewers. The target of the redirection, this week, is a parked domain website (ie, "search engine display") - for a product which was apparently installed, willingly , by the blog owners.

We're seeing a steady stream of reports, from blog owners in Blogger Help Forum: Something Is Broken , from Blogger blog owners, reporting the latest hijacking of their blogs. My blog is being redirected to a search engine display. or My blog has a porn popup attached! These are all blog owners who have installed the latest hack, willingly distributed by Blogger / Google. This appears to be yet one more gadget, intentionally installed by many Blogger blog owners, which is now redirecting unwilling viewers. The redirection target is a website which provides commercial advertisements for various Internet services, which creates a variety of symptoms , as reported in the forums.

This week, we're seeing a new stream of problem reports, from blog owners whose blogs are, once again, mysteriously redirecting their readers to unknown destinations . When I open my blog, it automatically directs to another website, which is SCM Music Player. This appears to be yet one more gadget, willingly installed by many Blogger blog owners, which is now redirecting uninterested viewers. The target of the redirection, in this case, is a website which is simply a commercial advertisement - for the product which was apparently installed, willingly , by the blog owners.

Recently, we've been seeing some odd problem reports in Blogger Help Forum: Something Is Broken , suggesting deviously hijacked blogs. My blog is requesting me to login, using a user name and password, when I view it. Given the URL of the window requesting the login, it's a simple matter for us to use the right forensic Internet software, and to locate a relevant snippet of code, frequently installed as part of the blog template. Sometimes, when we reply to the blog owner with advice to remove a bit of dodgy code, we get a response suggesting disbelief. Our advice Use the Template Editor, and remove the highlighted code snippet. may receive a confused or skeptical response. Where did that bit of code come from? I never installed that! How did the code in question get installed? Discussion of one possible scenario may require thinking outside the box. Not every unrecognised blog change is being caused by memory loss by the blog owner, after an intentional accessory install ...

Regularly, in Blogger Help Forum: Something Is Broken , we advise people about problem code or gadgets in their blogs. Generally, this follows reports by blog owners, that their readers are being redirected to unexpected and unwanted blogs and websites, from their blogs. Sometimes, we get the reply I can't remove the code. Every time I login to Blogger, I am redirected, just as my readers are being treated! When we see the latter complaint, we recognise yet one more blog owner who does not know how to properly protect himself, from malicious code and websites. Most people, who know about Layered Security, know that proper browser security is an essential complement to a properly chosen and maintained anti malware filter.

The recently observed problems with some third party gadgets , previously added by many blog owners to their blogs, leaves these blogs lacking various accessories. One of the gadgets identified is the "Recent Comments" / "Recent Posts" gadget pair. For many blog owners, this gadget is not impossible to replace. Blogger provides us with a native accessory, called a "Blog Feed" gadget, which will provide acceptable "Recent Comments" and "Recent Posts" functionality, for many blog owners. Look at the sidebar of this blog, for "The Real Blogger Status - Comments", and "The Real Blogger Status - Posts". Those are "Recent Comments" and "Recent Posts" gadgets, which are based on the Blogger supplied "Feed" gadget - which is not a third party accessory, and is not subject to future third party peccadilloes.

This week, we've seen several reports in Blogger Help Forum: Something Is Broken , from Blogger blog owners, reporting the latest hijacking of their blogs. My blog is being redirected to a spam site - was it hijacked? As is all too frequently the case, the redirection appears to come from third party code or gadgets, willingly installed by the blog owner. Examination of the website in question appears to indicate a long expired domain. This domain name expired on Nov 7 2012 11:32:24:000AM It's possible that, right now, this is not a maliciously planned hijack - though any expired domain can be re purchased for a devious or malicious purpose .

In the latest round of blog hijacks, from misbehaving or miswritten accessory gadgets, we have reports this month in Blogger Help Forum: Something Is Broken about blogs redirecting to "kunoichi . info". My Blogger site, xxxxxxx . blogspot . com, with over 8 years of blog posts archived, has been redirected without my permission, to "kunoichi . info". I see my blog for a few seconds before it goes to the new site.

We saw the symptoms of the first carefully engineered blog hijacks , in Blogger Help Forum: Something Is Broken , two years ago. During each succeeding holiday season, each attack has apparently become more and more deviously engineered. This season - each season starting in Fall of one year and lasting until Spring of the following year - we are seeing a hijack complement which appears to be devious in both marketing and installation technique, and which requires a complex search of the affected blogs. If you are receiving reports from your readers Your blog starts to load - but is quickly replaced by a page full of advertisements! you may need to exhaustively examine your blog for any third party code - and as always, the problem code may have been installed at any time in the past. When discovered, the hijacks are not consistently found in recently installed code.

In spite of my recently published caution against gratuitous additions of third party blog accessories, we're seeing a small yet steady stream of reports about mysterious blog hijackings, in Blogger Help Forum: Something Is Broken . When I view my blog, it shows up for a few seconds - and then forwards to this weird website, that I've never heard of. Not everybody is aware of the dangers of adding non Google developed code, to their blogs.

The Winter Holiday season is approaching, and this week we're seeing queries by some blog owners, getting ready. Why do my readers see a search display - instead of my blog? and How do I make it snow on my blog? and a few owners, and visitors Why does my browser freeze or lag when viewing this blog? Many blog owners, who publish craft, family, and personal themed blogs, just have to make their blogs reflect their holiday wishes for their readers. Only later, they may re think their decision.

And just as we saw earlier this year, we have more reports of blog hijacks. My blog is getting redirected to some other website. And, as noted last time , we see a possible "falling snow" decoration as the first suspect in the never ending drama of our blogs, under attack. <script src='http://skigeninfotech.com/snowstorm.js' type='text/javascript'></script> This problem, fortunately, was not too deceptive. My blog is getting redirected to some other website (http://fileinxt.com/?dn= skigeninfotech.com &fp=pqVXxjF5eZbZPUdjA2CrQZZYLeqa1yd9fqFglE50v8v4EC1bOn33UcPSed%2FwDeiJ9Reh2eiwg8SutCcQJKwtDg%3D%3D&prvtof=pvwzxikjk5Y8qIVO5T2y%2FXDEmNhqCs0%2B8Ro0gzCGabvCE6HiL7ziqtwSEZqp3rEKm6Jh9%2FJ1f%2F2wvhisupe6NXdlr3gpOBXWMdVDWrkFKlk%3D&poru=M%2F0o7laCl49QHRW5Qtdx3sFgJ9q8HQrB4cyfP%2Fqb9agYFzJufaOkqO8J%2BtnyVG5HntoKr9AJzMJSk1shzG2Y7oQgw7gogohmR%2Fc7iiJpC6Y%3D&cifr=1&flrdr=yes&nxte=js) A simple string search on "skigeninfotech" yi...

Recently, we've had a few reports, in Blogger Help Forum: Something Is Broken , from unwary blog owners I can't see my blog! I load it in the browser, and another website loads in its place! or I am getting reports from my readers that my blog contains a virus. or even Blogger just deleted my blog, and tells me that it contains malware. Help! Some of these are people who have seen a shiny gadget or website, and either added the gadget to their blog, or added a link to their blog - and now, they are regretting that addition. It's not difficult to add a link to your post or to a linklist gadget, or add a new HTML / JavaScript gadget to the template. Unfortunately, past experience has taught us that what we add to our blogs today may look and work great today - but not so great, next month (or even, next year). And even if you do add a shiny gadget or link, to your blog - and it does not cause an obvious problem - be aware that some of your readers will filter untrust...

In a new volume of the series " Tales Of The Hijacked Blogger Blogs ", today we have multiple reports of blogs redirecting to "hijriah.jentayu.com/hijriah.php". This tale is somewhat less exciting than the previous episodes in this long saga, however. The problem code, which is causing the hijacks, typically appears in various HTML gadgets, and is not difficult to find. The code appears to consist of simple HTML gadgets, intentionally installed by the blog owners. You'll probably not find this hack by editing the template HTML code - it will be an HTML gadget , located in your sidebar or maybe the blog footer / attribution section. If you use a text only proxy , like the Rex Swain HTTP Viewer or the Web-Sniffer View HTTP , you can retrieve the blog in safety. Then, do a simple text search on "hijriah.jentayu.com". You'll find something like </div><div class='widget HTML' id='HTML7'> <h2 class='title...

Occasionally, content that we don't recognise may show up in our blogs. There are several different ways that the bad guys may have, in getting their unwanted contributions into our blogs. If you read the latter article, don't find an explanation to your immediate problem there, and conclude that your blog has been hijacked, try not to panic. First, verify who has control of the blog in question. Go to Settings - Permissions, and examine the list of blog members. Do you recognise every administrator and author on the list? If you have access to the Permissions list, and have the "Add Authors" button, you still have control of the blog. If so, the blog has not been hijacked. Now, you have to find out what has actually happened, and ensure that you retain control. If you see an unknown administrator listed there, did you install an accessory improperly ? If you see an unknown author, did an invited author maybe create a second account or invite a friend , ...

As yet another chapter in the tale of the hijacked Blogger blogs , today we have reports of blogs redirecting to "freegadget2015.blogspot.com" and "freegadget-xde". For those newly experiencing this persistent assault upon our blogs, see the FAQ My Blog Has Been Hijacked - What Do I Do? for diagnosis and removal techniques. Note that you'll probably need to use the "Edit HTML" wizard, and delete the offending code , for expedient removal. >> Top

Blogger Support took control of the blog hijacking problem yesterday . Today, I did a search in "Add a Gadget", and found encouraging results. I believe that they are now trying to disable the installed gadgets - so if you see a blank space on your blog, that's possibly why. (Update 2010/11/25): And to celebrate Thanksgiving Day 2010, we see a report of yet another hijack attempt . >> Top