{"id":2520,"date":"2021-08-13T16:52:19","date_gmt":"2021-08-13T13:52:19","guid":{"rendered":"https:\/\/sms-man.com\/blog\/?p=2520"},"modified":"2021-11-30T18:45:23","modified_gmt":"2021-11-30T15:45:23","slug":"scammers-google-norway","status":"publish","type":"post","link":"https:\/\/sms-man.com\/blog\/scammers-google-norway\/","title":{"rendered":"How scammers attacked Google in Norway?"},"content":{"rendered":"<p><iframe title=\"Receive SMS online || SMS-MAN || SMS verification service 2022\" width=\"843\" height=\"474\" src=\"https:\/\/www.youtube.com\/embed\/VIjI_8MRWuA?enablejsapi=1?start=2&#038;feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen><\/iframe><\/p>\n<p>&nbsp;<\/p>\n<p>A large-scale attack has been going on on the Norwegian <a href=\"https:\/\/www.google.com\/\" target=\"_blank\" rel=\"nofollow\">Google search<\/a> for several days: on the first pages of the output for almost any queries, there is a high probability of meeting a Danish <a href=\"https:\/\/sms-man.com\/blog\/doorway-what-is-it-advices-q-a\/\" target=\"_blank\">spam domain<\/a> havfruen4220.dk, says web developer Alex.<\/p>\n<p>Redirection is configured on the domain: when the user goes to fraudulent sites that impersonate Norwegian news feeds or offer to &#8220;make quick money on the Internet&#8221;.<\/p>\n<p>Usually Google filters such sites and does not allow you to go to them, not to mention the output to the first pages of the search results. But the scammers managed to deceive the algorithms with the help of an image and a redirect system, the web developer claims.<\/p>\n<h2 style=\"text-align: center;\">What did the scammers do<\/h2>\n<p>Alex checked some of the popular and typical queries for Norway and found them in the top every time havfruen4220.dk. For example:<\/p>\n<p>The request of the largest grocery chain in Norway, REMA 1000 \u2014 is on the fifth page.<\/p>\n<p>For the query in Norwegian &#8220;how often do I need to take a shower&#8221; &#8211; on the first page of the search.<\/p>\n<p>One of the main queries in Google for the phrase &#8220;how to calculate&#8221; in Norwegian is &#8220;how to calculate a percentage&#8221;. Here is a spam site on the first search page.<\/p>\n<p>For the query &#8220;How often does Apple update iOS&#8221; &#8211; immediately 9 and 10 search results.<\/p>\n<p>Total on request havfruen4220.dk 9.95 million results are issued \u2014 and most of them are new and created in the last few days, the developer notes. To generate them, the scammers took data from a variety of sources: Twitter, news sites, random sites or a combination of them. There are other similar sites \u2014 they use a Danish domain .dk and are served by Cloudflare.<\/p>\n<p>If a Norwegian Google search bot or a user tries to open a spam site page using a direct link, it disguises itself and shows a cartoon with &#8220;Smeshariki&#8221;.<\/p>\n<p>But if a user visits one of the pages of a spam site, instead of its content, a js script is activated that redirects to fraudulent sites.Some of them disguise themselves as popular Norwegian news publications, articles in which&#8221; tell the secret of wealth &#8221; of a Norwegian celebrity. Usually the text ends with a financial scheme with cryptocurrencies. Others are fraudulent sites dedicated to making quick money on the Internet with &#8220;temporarily free&#8221; access. They also talk about how to get rich with the help of cryptocurrencies.<\/p>\n<h2 style=\"text-align: center;\">Why Google was deceived and how the company can fix it<\/h2>\n<p>The developer has several assumptions about how it was possible to circumvent Google&#8217;s protection:<\/p>\n<p>In the search results of the page havfruen4220.dk &#8220;they look quite decent&#8221;, it&#8217;s easy to get interested in them.<br \/>\nIt is possible that when entering from the IP address of the Google scanner, the scammers show the real content, but the developer &#8220;pretended&#8221; to Google and got the same picture from the main page havfruen4220.dk.<br \/>\nWhen a user opens a spam domain page, scammers block the opportunity to return to Google. Thus, they &#8220;suggest&#8221; to search algorithms that the user has found the necessary information on their site \u2014 since he did not return back to the search results. The algorithms consider the site &#8220;useful&#8221; and rank it even higher.<br \/>\nAfter the user is blocked from returning to the output, he has to search for information again.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>&nbsp; A large-scale attack has been going on on the Norwegian Google search for several days: on the first pages of the output for almost&hellip;<\/p>\n<div class='heateorSssClear'><\/div><div  class='heateor_sss_sharing_container heateor_sss_horizontal_sharing' heateor-sss-data-href='https:\/\/sms-man.com\/blog\/scammers-google-norway\/'><div class='heateor_sss_sharing_title' style=\"font-weight:bold\" ><\/div><ul class=\"heateor_sss_sharing_ul\"><li class=\"heateorSssSharingRound\"><i style=\"width:80px;height:25px;border-radius:5px;\" alt=\"Facebook\" Title=\"Facebook\" class=\"heateorSssSharing heateorSssFacebookBackground\" onclick='heateorSssPopup(\"https:\/\/www.facebook.com\/sharer\/sharer.php?u=https%3A%2F%2Fsms-man.com%2Fblog%2Fscammers-google-norway%2F\")'><ss style=\"display:block;\" class=\"heateorSssSharingSvg heateorSssFacebookSvg\"><\/ss><\/i><\/li><li class=\"heateorSssSharingRound\"><i style=\"width:80px;height:25px;border-radius:5px;\" alt=\"Twitter\" Title=\"Twitter\" class=\"heateorSssSharing heateorSssTwitterBackground\" onclick='heateorSssPopup(\"http:\/\/twitter.com\/intent\/tweet?via=smsmantweets&text=How%20scammers%20attacked%20Google%20in%20Norway%3F&url=https%3A%2F%2Fsms-man.com%2Fblog%2Fscammers-google-norway%2F\")'><ss style=\"display:block;\" class=\"heateorSssSharingSvg heateorSssTwitterSvg\"><\/ss><\/i><\/li><li class=\"heateorSssSharingRound\"><i style=\"width:80px;height:25px;border-radius:5px;\" alt=\"Telegram\" Title=\"Telegram\" class=\"heateorSssSharing heateorSssTelegramBackground\" onclick='heateorSssPopup(\"https:\/\/telegram.me\/share\/url?url=https%3A%2F%2Fsms-man.com%2Fblog%2Fscammers-google-norway%2F&text=How%20scammers%20attacked%20Google%20in%20Norway%3F\")'><ss style=\"display:block;\" class=\"heateorSssSharingSvg heateorSssTelegramSvg\"><\/ss><\/i><\/li><li class=\"heateorSssSharingRound\"><i style=\"width:80px;height:25px;border-radius:5px;\" alt=\"Reddit\" Title=\"Reddit\" class=\"heateorSssSharing heateorSssRedditBackground\" onclick='heateorSssPopup(\"http:\/\/reddit.com\/submit?url=https%3A%2F%2Fsms-man.com%2Fblog%2Fscammers-google-norway%2F&title=How%20scammers%20attacked%20Google%20in%20Norway%3F\")'><ss style=\"display:block;\" class=\"heateorSssSharingSvg heateorSssRedditSvg\"><\/ss><\/i><\/li><li class=\"heateorSssSharingRound\"><i style=\"width:80px;height:25px;border-radius:5px;\" alt=\"Pinterest\" Title=\"Pinterest\" class=\"heateorSssSharing heateorSssPinterestBackground\" onclick=\"javascript:void( (function() {var e=document.createElement('script' );e.setAttribute('type','text\/javascript' );e.setAttribute('charset','UTF-8' );e.setAttribute('src','\/\/assets.pinterest.com\/js\/pinmarklet.js?r='+Math.random()*99999999);document.body.appendChild(e)})());\"><ss style=\"display:block;\" class=\"heateorSssSharingSvg heateorSssPinterestSvg\"><\/ss><\/i><\/li><\/ul><div class=\"heateorSssClear\"><\/div><\/div><div class='heateorSssClear'><\/div>","protected":false},"author":8,"featured_media":2523,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v15.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How scammers attacked Google in Norway? - SMS-Man Blog<\/title>\n<meta name=\"description\" content=\"A large-scale attack on the Norwegian Google: on the first pages of the output is a high probability of meeting spam domain havfruen4220.dk.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/sms-man.com\/blog\/scammers-google-norway\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How scammers attacked Google in Norway? - SMS-Man Blog\" \/>\n<meta property=\"og:description\" content=\"A large-scale attack on the Norwegian Google: on the first pages of the output is a high probability of meeting spam domain havfruen4220.dk.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/sms-man.com\/blog\/scammers-google-norway\/\" \/>\n<meta property=\"og:site_name\" content=\"SMS-Man Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/smsmanSERVICE\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/smsmanSERVICE\" \/>\n<meta property=\"article:published_time\" content=\"2021-08-13T13:52:19+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-11-30T15:45:23+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/sms-man.com\/blog\/wp-content\/uploads\/2021\/08\/Bez-nazvaniya-4.png\" \/>\n\t<meta property=\"og:image:width\" content=\"499\" \/>\n\t<meta property=\"og:image:height\" content=\"500\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@smsmantweets\" \/>\n<meta name=\"twitter:site\" content=\"@smsmantweets\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\">\n\t<meta name=\"twitter:data1\" content=\"3 minutes\">\n<!-- \/ Yoast SEO plugin. -->","_links":{"self":[{"href":"https:\/\/sms-man.com\/blog\/wp-json\/wp\/v2\/posts\/2520"}],"collection":[{"href":"https:\/\/sms-man.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sms-man.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sms-man.com\/blog\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/sms-man.com\/blog\/wp-json\/wp\/v2\/comments?post=2520"}],"version-history":[{"count":4,"href":"https:\/\/sms-man.com\/blog\/wp-json\/wp\/v2\/posts\/2520\/revisions"}],"predecessor-version":[{"id":5636,"href":"https:\/\/sms-man.com\/blog\/wp-json\/wp\/v2\/posts\/2520\/revisions\/5636"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sms-man.com\/blog\/wp-json\/wp\/v2\/media\/2523"}],"wp:attachment":[{"href":"https:\/\/sms-man.com\/blog\/wp-json\/wp\/v2\/media?parent=2520"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sms-man.com\/blog\/wp-json\/wp\/v2\/categories?post=2520"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sms-man.com\/blog\/wp-json\/wp\/v2\/tags?post=2520"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}