Social Icons

Pages

Showing posts with label Malware. Show all posts
Showing posts with label Malware. Show all posts

Sunday, 6 October 2013

Team Blog Ownership, And Abuse Classification

We see some people, posting in Blogger Help Forum: Something Is Broken, who have problems with blogs under team ownership, and abuse classification.
My blog was deleted as spam but I don't spam! BTW, one of the other administrators of my blog recently had his Google account blocked.
We've observed, a few times, that team blog relationships create interesting complications, with various Blogger issues - and this appears to represent yet one more complication.

In most cases, when a Blogger account or blog is deleted or locked, the owner of the account or blogs affected should see an online notification, and / or receive email informing of the action taken.

There are several reasons why notification - email or online - may not always be provided.
  • Blogger accounts, based on bogus or inactive email addresses, will not provide email notification.
  • A person who uses multiple Blogger accounts, accidentally or intentionally, will only see the dashboard for the account currently logged in.
  • An owner of a Blogger account, recently unlocked after detected suspicious / unusual activity, will see only an empty dashboard, when logging in.

The team blog ownership relationship appears to provide one more reason for lack of notification.
  • Administrators of blogs under team ownership may not see notification, when one of the team members has a Blogger account deleted or locked.

Both Blogger accounts deleted for non repentant abusive activity, and Blogger accounts locked when suspicious / unusual activity is detected, appear to present this complication, with blogs under team ownership.

When a Blogger account is deleted after the owner repeatedly produces TOS violations, all blogs owned by the account are apparently deleted. It's possible that, when a blog is deleted, team ownership issues are overlooked in the blog deletion process - and the blog simply disappears from the dashboards of the other team members. It's also possible that this is a predictable group action - comparable to affiliate network detection.

When a Blogger account is locked after suspicious / unusual activity is detected, all owned blogs simply disappear from the dashboard of the owner. Blogs owned by a locked account are under automatic security review, with no appeal by the owner being possible. Team administrators are unlikely to have any alternative appeal opportunity, for a blog under review when an owning account is locked.

The latter two scenarios represent two reasons why, if we see the complaint in Blogger Help Forum: Something Is Broken
My blog has disappeared from my dashboard, and is not online!
One initial question should be
Was the blog under team ownership?

>> Top

Saturday, 28 September 2013

Team Blogs, And Confusion About Blogs Locked After Detected Account Hacking

We've been discussing deleted blogs, resulting from Blogger accounts locked after suspicious account activity is detected, for some time.

Recently, we've seen a variant on the account lock / deleted blogs problem.
I made one of my friends an admin for my blog. When Blogger deleted His Blogger account and his blogs, they deleted my blog also.
Here, we see the possibility of detected hacking, affecting other members in a team blog ownership.

If someone sets up a blog, then invites his friends to be administrators, everybody on the team becomes equal owners. This can also happen when one person maintains two or more Blogger accounts - whether accidentally or intentionally.

That's the definition of a team blog - and it's one known problem with team blogs. This case shows us another problem with team blogs.

If somebody on the team has a Blogger account locked for detected hacking, all blogs owned by that account are taken offline, for security checking. Any blogs owned by that account are going to simply disappear from the dashboards of all owners - because all owners produce the same security risk, to any owned blogs.

When a Blogger account is locked, review of blogs owned by the account starts after the account is unlocked. If the team member with the locked Blogger account doesn't get the account unlocked, the blogs owned can't be reviewed.

Once again, we see why it's a good idea to only have active team members, as blog owners.

>> Top

Monday, 26 August 2013

Repeated TOS Violations Are Punished Gradually

Some blog owners don't understand the serious nature of repeated violation of TOS Policy, in Blogger blogs - and how offenses are handled, by Google.

We've seen several reports, in Blogger Help Forum: Something Is Broken, from blog owners who appear to be unclear about the consequences of repeated TOS Violations.
I got email from Blogger, about my Blogger account.
We'd like to inform you that we've received another complaint regarding a blog that you administer. Upon review of your account, we've noted that you've repeatedly violated the Terms of Service: http://www.blogger.com/go/terms. Given that we've provided you with several warnings of these violations and advised you of our policy towards repeat infringers, we've been forced to disable your Blogger service.
How do I get my blog restored?

This example appears to represent the final step, in a multi step policy.

It appears that Google takes a multi step approach, towards repeated TOS violations - such as hosting of malware, porn, and / or spam - in Blogger blogs. This is similar to the DMCA Violations punishment process.
  1. Unlike DMCA violations, individual posts are not deleted.
  2. Deletion of offending blogs.
  3. Deletion of offending Blogger account(s) (and blogs).

With a TOS initiated blog deletion, the blog owner is expected to have the blog reviewed. If the review determines the blog to be unrighteously deleted, the blog is restored - though there may be side effects.

If the blog owner does not wish to have the blog reviewed, he / she is allowed to start over, with a new blog - but will have to publish to a new URL. Content lost must be recovered by the owner - and the owner should be more careful with future blogs.

If the blog owner continue to publish blogs which violate TOS, any Blogger accounts involved, along with any other blogs owned by the deleted accounts, will be deleted.

We see that an appeal is possible.
Next steps for suspended accounts: If you believe your access to this product was suspended in error, contact us.

With any blogs published to a non BlogSpot domain, the domain URL(s) will remain in use, in the Google database - though the domain owner is free to use the domain outside Google address space. If the offender wishes to start over, both new BlogSpot and non BlogSpot URLs will be required.

As with other issues with email delivered warnings, there will be cases when the owner may not receive warnings in a timely fashion. Even so, the owner is responsible, when he / she offends, repeatedly.

Blogs under team ownership are apparently vulnerable to action taken against any team member. In some cases, blogs will simply disappear from the dashboards of the other team members, with no appeal or review request being possible.

It's possible that legal notice, provided by Google through email, will supercede ongoing forum advice - even if email sent is not received by the owner.

>> Top

Wednesday, 3 July 2013

Hacking Detection Is (Generally) Not The Fault Of The Blogger Account Owner

We've been helping Blogger blog owners deal with spurious fuzzy content classification, for many years.

We started out, long ago, with blogs deleted because of spam classification. Later, Blogger added malware classification - and most recently, porn classification ("adult content", with objectionable advertisements). These three classification categories involve fuzzy blog content analysis.

A fourth category, which similarly results in blog(s) being deleted, I describe as "hacking detection". This category complements the other three, because the primary symptom of all four are remarkably similar.
Help me! Blogger has deleted my blog!!
This is a frequent complaint, seen in Blogger Help Forum: Something Is Broken.

One problem with using the term "hacking" is that some account owners take this diagnosis personally.
Why do you mention hacking? I am not a hacker!
And in almost all cases, the owners are correct.

Blogs are deleted by Blogger, currently, because of several different reasons.
  1. DMCA Violation.
  2. Hacking detection.
  3. Malware detection.
  4. Porn detection.
  5. Spam detection.
I list the different categories, collectively, because they are frequently reported, using the common symptom.
My blog was deleted, and I did not do it!

DMCA, malware, porn, and spam are generally based on what the blog owner did (though in many cases, what the owner "did" was simply to publish a blog). Hacking, on the other hand, is generally based on action by someone other than the blog owner.

DMCA, malware, porn, and spam classifications are based on content analysis (automated), or complaint (manual) - and these classifications can be somewhat avoided by the blog owner. Don't steal content or publish a blog containing malware, porn, or spam, to reduce your chance of having the blog classified.

Hacking detection, on the other hand, is based on analysis of Blogger account traffic - and this classification can not be avoided, as easily, by the blog owner. Hacking generally involves use of a cloud of computers, to systematically break into a Blogger account owned by the victim.

Though frequently, a hacking attack starts with unintentional disclosure of personal information by the victim, actual hacking activity is typically not initiated by the victim.

Detection of hacking attacks is best conducted by Google, because they can look for repetitive activity against multiple Blogger / Google accounts, from multiple computers located worldwide.
  • Most account owners can login to their accounts in one or two tries.
  • Very few account owners will, intentionally, attempt to login to their accounts, concurrently, from computers in Argentina, USA, and Zaire.
  • Very few computers will be used to access Blogger accounts owned by people in Brazil today, in China tomorrow, and in Denmark next week.

Recovery from hacking detection requires willful action by the victim - though Blogger makes the required action so simple, its purpose becomes transparent. The victim, or account owner, is simply required to change the account password, solve a CAPTCHA, and / or verify account ownership by providing various personal details.

Having initiated hacking recovery, the account owner is able to login to Blogger - but is greeted by an empty dashboard.
You are not yet the owner of any blogs. Create a blog, and get started!
This is where the confusion starts.

Not all Blogger account owners personally publish a blog. Some people setup Blogger accounts simply to comment on, and / or Follow blogs published by other people - and won't, necessarily, publish a blog using the account in question.

Blogger accounts with no owned blogs may still be under attack by hackers - and are subject to hacking detection. This makes the primary symptom so confusing.
You are not yet the owner of any blogs. Create a blog, and get started!
People who don't own any blogs (under this Blogger account) may, or may not, see this as a problem.

In cases where the initial symptom is a deleted blog, the blog owner must recover the hacked (locked) account, before the blog can be recovered. This is one more scenario where unplanned, anonymous blog ownership, just causes more confusion.

Having initiated hacking recovery, a blog owner is simply expected to wait patiently, until the blogs owned by the account are verified as free of content added by the hacker. Unfortunately, we sometimes see the blog owner, impatiently reporting in Blogger Help Forum: Something Is Broken.
I had to change my password, and having done that, Blogger deleted my blog!

Sometimes, hacking detection starts with the Blogger account owner, repetitively trying to recover access to the account, by sequentially trying every possible password (sometimes trying the same password, repeatedly).
I know it's one of these! But which one? Did I maybe type the one, incorrectly??
This repetitive action looks the same as any malicious hacking attack - and that is why hacking detection is so hard to canonically diagnose.

Please, consider these details, the next time you post your problem report.
Help me! Blogger has deleted my blog!!
In some cases, I may respond with a mention of hacking detection. If I do that, please don't take my response as a personal attack upon you.
Why do you mention hacking? I am not a hacker!

Even though being the victim of a hacking attack is not the fault of the account / blog owner, that person may still have to bear some of the responsibility. In general, blog owners have to support themselves - learn how to protect themselves, and use 2-step verification.

>> Top

Thursday, 27 June 2013

"Adult Content" Blogs, And New Blogger Monetisation Restrictions

This week, we're seeing some reports from a few blog owners who recently received a disturbing email message, mentioning their blogs and adult advertisements.
I received an email stating I have adult content on my blog, and that a new policy will cause certain blogs to be deleted. Is my blog vulnerable to deletion, under this new policy?

Like many spammers, these blog owners may be asking for a whitelisting of their blog - which is something that Blogger just won't provide.

The legendary email, recently received, is somewhat ambiguous in wording.
You are receiving this message because you are the admin of a blog hosted on Blogger which is identified to have Adult content.

Please be advised that on June 30th 2013, we will be updating our Content Policy to strictly prohibit the monetization of Adult content on Blogger. After June 30th 2013, we will be enforcing this policy and will remove blogs which are adult in nature and are displaying advertisements to adult websites.

If your adult blog currently has advertisements which are adult in nature, you should remove them as soon as possible as to avoid any potential Terms of Service violation and/or content removals.

The policy discouraging monetised "adult content" blogs is not new - we have actually been warning people about this for years, in the Malware / Spam Appeal Guidelines. We cite the Guidelines a dozen or so times daily, in various malware and spam review discussions in Blogger Help Forum: Something Is Broken.
Blogger / Google has repeatedly stated that some blog content is not acceptable, because it constitutes or encourages abusive activity, such as hacking, porn, and spam, in the Blogger Internet space.

Here is the current list of examples, developed by Blogger / Google, and the Top Contributors of Blogger Help Forum.
  • Affiliate marketing (Please, don't confuse this with "affiliate networking"!).
  • Automated traffic redirection, to another Blogger blog, or to non Google hosted content.
  • Commercially funded adult content.
  • Content created with scripts and programs, rather than by hand.
  • Content or links which reference account hacking / password distribution / password sharing.
  • Content or links which reference code deconstruction / reverse engineering, to bypass normal use of proprietary
  • software.
  • Content or links which reference referral-based activities such as GPT ("Get Paid To"), MLM ("Multi-Level Marketing"), MMF ("Make Money Fast"), MMH ("Make Money from Home"), PTC ("Pay To Click"), or PTS ("Pay To Surf").
  • Content scraped from other blogs / websites.
  • Copyright Infringement.
  • Large blogs with multiple, unfocused / unrelated subjects.
  • Links to Illegal Downloads / Streaming / Torrents.
  • Monetizing of adult content, aka porn spam.

The specific blogs, targeted by the email, are not difficult to identify. "Adult Content" blogs will generally bear an interstitial "Content Warning", awarded either voluntarily or involuntarily.

In odd cases, people may receive the email, but may not have any blogs affected by the policy - and in this case, they will simply have to ignore the email. Blogger Support can only review blogs, when they are actually deleted or locked.

In other cases, people may not receive the email. Just as with malware and spam classifications, all blog owners won't be contactable by email.

If the adult content classifier is designed similar to the malware and spam classifiers, it will use a fuzzy detection process to identify the undesirable "adult content" advertisements.

Since fuzzy malware / spam classification does not support whitelisting, porn classification won't either. Blog owners asking "Is my blog safe?" are unlikely to get any useful answers.

My suspicion is that owners of the most popular and productive "adult content" blogs will move to alternate hosting. Some of them may relocate to WordPress - until WordPress, similarly, rejects them.

Some owners, choosing to remain in Blogger, will take the warning seriously, and remove any ads.
If your adult blog currently has advertisements which are adult in nature, you should remove them as soon as possible as to avoid any potential Terms of Service violation and/or content removals.
Various possible "adult content" blogs, with and without "adult advertisements", remaining in Blogger hosting, will be classified and deleted, and will result in more reports in Blogger Help Forum: Something Is Broken.
Why was my blog deleted?

We'll simply end up with more discussions with requests for review and reinstatement - and more uncertainty. Some blogs will be restored promptly, with others requiring careful deliberation. And some blog owners will simply be told
Sorry, your blog cannot be restored. It was recently confirmed as a adult content host, with unacceptable advertisements.


>> Top

Monday, 24 June 2013

Hacking / Malware / Porn / Spam Classification, And Effects Upon Search Engine Reputation

Occasionally, we see concern in Blogger Help Forum: Something Is Broken, about the long term effects of Blogger hacking / malware / porn / spam classification or detection.
My blog was deleted, because of spurious spam classification - and later restored to service. Did my blog lose search engine reputation, in Google?

Any time a blog goes offline, its reputation is affected, to some extent. How much effect a hacking / malware / porn / spam classification or detection has, on any given blog, will vary widely.

Every blog or website has different factors, which affect its reputation.
  • Readers, and links in their blogs and websites.
  • Readers, and inherent reputation.
  • Search engines, and inherent reputation.
These factors will differ, from blog to blog, in almost infinite variety.

If your blog has readers who maintain their own blogs and websites, some will see you as a useful source of information, and will link from their blog / website, to your blog. As a readers blog / website is indexed by a search engine bot, and a link to your blog is encountered, your blog is indexed. This causes indirect search engine reputation.

Any time your blog is offline, even briefly, it loses reputation. If you use Google Webmaster Tools, look at the indexing logs. One event which you will see, from time to time, mentions "404 Not Found". Any time a search engine bot is indexing your blog, and it encounters a "404 Not Found", your blog loses reputation.

Loss of search reputation is similar to a person dying from blood loss. How fast the blood loss, and how long the loss continues, will affect how likely death will occur.

The longer your blog is offline, the more "404 Not Found" events will be logged, as the search engine bots attempt to index the various pages in the blog. Each succeeding "404 Not Found" represents your blogs reputation, leaking away, drop by drop. The longer your blog is offline, the more reputation loss it suffers, from indirect and direct indexing.

Until reputation is regained, your blog appears lower in search results, because of lower page rank. You suffer from less search engine generated traffic, and less new readers. This is a circular effect - less search engine reputation leads to less new reader traffic, which leads to less search engine reputation.

When your blog is reviewed and restored to online status, indexing resumes. Each time a search engine bot indexes the blog, and does not encounter a "404 Not Found", reputation picks up, again. Slowly, your blog regains its former reputation.

All 3 factors contribute to the loss of reputation, while the blog is offline - and to the regaining of reputation, when the blog is restored. This is similar to the effect of re indexing after the URL is changed.

How much reputation is lost and regained will vary, from blog to blog.
  • Each blog has different readers, with differing links in their blogs and websites.
  • Each blog has different readers, with differing inherent reputation.
  • Each blog has differing search engine relationships, with differing inherent reputation.
The direct result, of all of this, explains the frantic posts, in Blogger Help Forum: Something Is Broken
My blog was deleted by Blogger. How promptly can I get it restored?

If this threat concerns you, use Google 2-step verification, to protect your Blogger / Google account - and your blogs - from hacking. And be discrete in advertising and publishing your blog.

>> Top

Sunday, 9 June 2013

Blog Content, And Confusion About Blogs Locked After Detected Account Hacking

One Blogger mystery involves the varying periods of blog unavailability, after hacking activity is detected.
My blog just disappeared from my dashboard - and no, it's not listed under "Deleted blogs"!

When the owner mentions the notice about "suspicious" / "unusual" account activity, or having unlocked the account (by solving a CAPTCHA, receiving a phone message, changing the password) - and is advised to wait "24 to 48 hours" - many ask the obvious.
Is "24 to 48 hours" really accurate?

In reality, the legendary "24 to 48" hour time period is only a ball park figure - and both Blogger / Google, and the blog owner, contribute to the uncertainty.

The well known advice to "Wait 24 to 48 hours", after a Blogger account is locked for suspected hacking activity, is only an estimation of the waiting time, which the owner may have to endure. This is account / blog integrity verification.

There are several factors which can contribute to the accuracy of "24 to 48 hours" (which maybe should be stated as "one to two business days").
  • Availability of essential Blogger / Google personnel.
  • Current hacking activity level, and ongoing Blogger / Google workload.
  • Blog content, which complicates hacking payload analysis.

We've referenced the first two factors (personnel, and hacking activity level) in the well known Blogger FAQ How long will it take?. The third involves detail which only the blog owner can provide. Many blog owners contribute to this uncertainty, in the development of their blogs.

There are several types of content, which hackers like to add, to blogs temporarily under their control.
  1. Advertising - and similar shiny accessories.
  2. Custom code - and various template tweaks.
  3. Links to other blogs - and to websites outside Google address space.
  4. Team memberships - and multiple blog owners.
All of these features, also added by the owner - and allowed (and encouraged) by Blogger - can require extra effort as a blog is validated, after detected hacking activity.

Blogger / Google security experts, in examining an account / blog, must look for features possibly added by the hacker. Security experts have no immediate knowledge what was added by the owner, long ago - as opposed to by a hacker, more recently.

Any advertising, custom code, external links, or team memberships, intentionally added by the owner, will contribute to time spent validating blog integrity.
  • Leave a setting or tweak added by the hacker - and the blog remains a security risk, when returned to service.
  • Remove a setting or tweak added by a blog owner - and the blog becomes broken, when returned to service.
Neither is desired, by the blog owners - nor by Blogger / Google.

More accessories and tweaks == more time spent by security experts == more time the blog remains offline, while the owner waits in uncertainty.


This uncertainty, added to delayed deletion caused by cache latency, leads to mystery.

All of this brings to mind the old adage.
KISS
Keep it simple, stupid.

>> Top

Sunday, 28 April 2013

The Mysterious "Deleted blogs" Dashboard Link

Occasionally, we see signs of confusion, in Blogger Help Forum: Something Is Broken.
Where is the "Deleted blogs" link?
or
How can I recover my blog, if there's no link on the dashboard??
These blog owners don't understand that "Deleted blogs" only appears, when there are deleted blogs that can be recovered.

Not all blogs, having vanishing from the dashboard, will be recoverable by the owner.
  • A blog deleted / locked after hacking activity was detected won't be recoverable.
  • A blog owned under another Blogger account won't be recoverable.
  • A blog that does not exist won't be recoverable.
If the Blogger account owns no blogs that are recoverable, there won't be a "Deleted blogs" link on the dashboard.

If the Blogger account owns other blogs, that are not currently deleted, those blogs will be listed. If the Blogger account owns no recoverable blogs, the blog owner sees a monolithic message
You are not an author on any blogs.

In some cases, the blog owner will be advised to clear cache, cookie, and sessions - then restart the browser, and login to Blogger. In other cases, the solution will be to wait 24 to 48 hours, and check again. Just don't waste time looking for a link that may not be there - and try to understand why the link may not be there.

>> Top

Monday, 8 April 2013

Blogger Blogs Cannot Be Used As Gateways

We see evidence of confusion, from time to time, in Blogger Help Forum: How Do I?.
How do I move an established blog to WordPress (or any other platform), while retaining the history, reader interest, search engine reputation?
Some blog owners think blog readers are cattle (to be herded from blog to blog) - or monkeys (to be attracted by shiny things).

We've known for some time, that Blogger blogs cannot be used as gateways, with traffic automatically redirected from one blog to another - or from a blog to a non Google website. Use of traffic redirection scripts is a known cause of blogs classified as malware hosts.

If you wish to relocate a Blogger blog in another hosting service, you can always publish your Blogger blog, and a non Google blog / website, as dual hosts, in a non BlogSpot domain.

With your Blogger blog and non Blogger website published to the same domain, you can then combine the two, dynamically. Just remember to add unique content to each, periodically, to retain search engine reputation.
  1. Publish your Blogger blog to a host in your custom domain.
  2. Publish your WordPress (or any other platform) blog to a host in your custom domain.
  3. Combine the two blogs.
  4. Let your readers access either blog, as their choice.
  5. Update both blogs, to retain search engine reputation, regularly.
  6. When the WordPress (or any other platform) blog receives enough reputation and traffic, make the Blogger blog into a stub blog.

Just don't build a maze of blogs and web sites - and don't waste time or money artificially developing traffic. Blogger blog readers are attracted by interesting and useful content - and are retained by new content, added periodically.

And don't try adding clever code, to shuffle your readers from one blog to another.

>> Top

Thursday, 14 March 2013

Confusion Over Accounts Locked For Suspicious / Unusual Account Activity

One of the more intriguing tales of Blogger blogs, currently being explored, involves blogs mysteriously deleted by Blogger.
My blog just disappeared from my dashboard - and no, it's not listed under "Deleted blogs"!
In some cases, the owner knows more than is implied, from the obvious wording of that problem report.

As Blogger / Google continues to improve the hacking / malware detection and removal process, they are making the recovery of accounts locked for "suspicious" / "unusual" activity easier - and more transparent. The increased transparency may, in some cases, cause mystery.

Diagnosing the many mysterious blog disappearances, currently being reported in Blogger Help Forum: Something Is Broken, may involve what the blog owner does not report - as much as what the owner does report.

Blogger / Google is constantly refining the hacking detection / recovery process, to both improve the possibility that any activity will be detected, and to make it easier for the victims of the hacking to deal with the recovery process. As they make it easier for the owners to recover the accounts locked, they make it less likely that the owners will mention the locked account recovery, when later reporting the blogs, mysteriously missing from the dashboard.

In some cases, the blog owner will provide vague clues, which refer to an immediately previous account unlock.
  • Required to change the account password.
  • Required to provide a phone number - and receive either a text or voice message with a recovery code.
  • Required to solve a CAPTCHA.
All of these clues can be relevant to a locked account, or to various other anti-hacking / anti-spam activity by Blogger / Google - and can be overlooked as a locked account symptom, when stated in a forum problem report.

In other cases, the only clue provided will be that the blogs in question are missing, and not listed in any dashboard list - "Deleted blogs", "Locked blogs", or "My blogs". In cases where we've simply reported missing blogs for malware / spam review, to Blogger Support, we're later advised to instruct the blog owner to recover the account.

Since immediate review of any blog cannot be always guaranteed by Blogger Support, it's to everybody's benefit that we request clues to verify the problems being reported. Unfortunately, the questions asked may not always seem relevant to some blog owners, unhappy about the mysterious loss of their blogs - even though they may contribute to the problem, inadvertently.

And thanks to the possibility that not all blog owners may even get a notice when their accounts are locked, owners with multiple accounts may not even realise that a given Blogger account is locked. These owners find out that a given blog has been deleted, only after it goes offline and expires from cache. This will make some blog owners even less cooperative, when asked to provide diagnostic details about their problems.

>> Top

Sunday, 10 March 2013

Blog Owners, Unable To Request Restore Of A Deleted Blog

One of the more intriguing issues, seen in Blogger Help Forum: Something Is Broken, involves people unable to recover control of their blogs.
I recently changed ISPs, and now I can't login to update my blog.

Occasionally, this issue becomes more complicated, because the blog is deleted - and the owner can't request that it be restored, using the automated review request wizard. Sometimes, the would be blog owner may to try to bypass the current blog recovery policy, by claiming special circumstances.
The blog has been deleted. I received no suspicious activity or password change notification emails, or emails of any kind related to my blog.

What is the story here? Can blogs just disappear from the Blogosphere, without the involvement of the blog owners - and be unrecoverable?

Recovery of a deleted blog starts with the requirement that only a blog owner can un delete a deleted blog - and this is where many mysterious disappearances start.

Since a Blogger blog is the property of the owner, and the owner is allowed to delete a blog any time required, it would not be right to let people who are not the owner un delete a blog - or demand that the blog be un deleted. To enforce this requirement, Blogger added the dashboard based Restore wizard.

Since only the owner will have the deleted blog listed in their dashboard "Deleted Blogs" list, only the owner can request restore of the blog in question.

The dashboard Restore wizard serves blog owners, with blogs deleted under various circumstances.
  • Deleted by the owner.
  • Deleted by Blogger, as a suspected spam host.
  • Deleted by Google, for TOS Violation.
Any deleted blog will appear in a special dashboard list, "Deleted Blogs" or "Locked Blogs" - when it can be recovered. If the blog is not recoverable by the owner, there may not be a link.

There are specific cases where a deleted blog may not be recoverable using the recovery wizard.
  • The blog is locked, pending integrity check (following account lock for suspicious activity).
  • The blog is owned under a different Blogger account, and is listed on another dashboard, under "Deleted blogs".
  • A blog owner deleted the blog, long ago - and the blog is no longer recoverable.

A blog locked, pending integrity check, cannot be requested for restore. The owner has to first have the owning account unlocked. Similar to the account recovery process, Blogger / Google will require that the owner provide proof of ownership, before the account will be unlocked. With the account unlocked, security specialists will inspect each blog owned by the account, and verify that each does not contain evidence of tampering by a temporarily successful hacker.

While a blog is under integrity check, it won't be listed on the dashboard of the owner - either under "Deleted blogs", "Locked blogs", or "My blogs". Neither the owner, nor any third parties, will be able to do anything except wait, patiently.

Blogs found to contain malware can be locked as TOS Violations, with the owner later required to remove the malware found. This requirement will apply for malware installed by the owner (intentionally, or unintentionally), or for malware installed by a hacker.

With a blog locked pending malware removal, the owner is given the benefit of the doubt, and allowed to simply remove the malware, no questions asked. In some cases, Blogger may be able to assist by providing specific identification of the malware found - but this won't happen, consistently.

A blog owned under another account must be un deleted by the owner of the other account. Again, only a blog owner can have a blog restored - whether deleted by an owner, or by Blogger / Google.

A blog deleted over 90 days previously cannot be recovered. It won't appear on the dashboard of any (former) owner, since it can't be recovered.
It's dead, Jim.

The basic rule is simple. If your blog was deleted, and if you're able to un delete it (or request un deletion), you'll have a link on your dashboard. If a blog is not listed on your dashboard, you can't request, with any predictable success, that it be un deleted - any more than you can demand that a non deleted blog be restored to your control.

>> Top

Sunday, 3 March 2013

Some Blogger Blogs Being Locked As Malware Hosts, Because Of Malicious JavaScript

For a long time, we've been dealing with various malware / spam mitigation issues, in Blogger Help Forum: Something Is Broken.

Recently, malware detections, long simply identified as "Malicious JavaScript" in the well known Spam Appeal Guidelines, was given its own identity, and a separate classification / appeal process. We're now seeing several common types of JavaScript, included in blogs which are typically mentioned in forum reports.

It may be helpful to describe some examples of JavaScript code being seen, so blog owners can avoid making the same mistakes, by not including these scripts in their blogs.

There are 3 common types of JavaScript applications, found in many blogs with the owners requesting review / unlock action.
  1. CPA / Cost Per Action.
  2. Traffic Redirection, targeting other blogs / websites.
  3. Traffic redirection, targeting the canonical URL for the host blog.


CPA / CPALeads / Cost Per Action, and similar online marketing terminology, involves providing a reward for viewing a blog, or for subscribing to the blog feed. Some CPA scripts may be used to collect email addresses, also known as "email address mining", later used for hacking activity or spam distribution.

CPA scripts present another problem. Since Blogger blogs are intended to reward the readers by providing interesting and unique content, blogs which use CPA may be improperly designed or maintained. Blogger wants the blog owners to publish blogs which entertain or inform their readers - not blogs which require artificial or ingenious techniques to generate traffic, and visitor activity.

Traffic Redirection, targeting other blogs / websites is a technique enjoyed by many hackers and spammers. The use of some blogs as gateways, leading to redistributors, which in turn lead to payload blogs or non Google websites, is part of many hacking / spam attacks. Google is trying to restrict the use of Blogger blogs as malware / spam hosts - and actively prevents scripts, which only shuffle readers from one blog to another, without choice.

Even though Blogger will not encourage you to move your blog, to Tumblr, Weebly, WordPress, or wherever, you are allowed to do this - if you feel the need.
Hello, faithful readers:

This blog is now hosted at my new blogging host. Please update your blog lists and bookmarks!
If you must do this, it's OK to post a notice, in your Blogger blog. You can even put a link, to the new blog, in the notice. You just can't use JavaScript, to automatically send the reader to the new blog.

Traffic redirection, targeting the canonical URL for the host blog, is a technique used by some blog owners who perceive Country Code Alias Redirection to present a problem. Some accessories installed on their blogs, and various non Google services which may be used to provide activity on their blogs, may not properly reference the canonical URL tag included in all Blogger blogs.

Since Blogger / Google wants all Blogger blog owners to benefit from improved world wide access to Blogger blogs, blogs which employ automatic canonical URL redirection may damage the effect of CC alias redirection. Blogs which host scripts which immediately redirect readers to the canonical URL, and are considered undesirable by any host government, may force an offended host government to block the entire Blogger service, in their country.

To prevent malicious misuse of Blogger by hackers and spammers, and to encourage effective long term use of Blogger by legitimate blog owners, Blogger / Google may detect any blogs which use these types of scripts as part of their general malware / spam classification strategy. Given the ability and willingness of the blog owner, to remove the JavaScript code in question, most blogs can be returned to service - but each blog will remain offline, until the removal is verified.

It's to everybody's benefit to identify, and to avoid use of, these scripts in our blogs, before it's too late. If your blog contains one of these scripts, why not remove the problem now, instead of waiting until you too have to post your problem report, in the forum
Help me! My blog was just locked for
MALICIOUS JAVASCRIPT
What do I do, now?

>> Top

Friday, 22 February 2013

Browser Cache, And Confusion About Blogs Locked After Suspected Account Hacking

The effects of browser cache, upon our Internet life, are not always understood.

Most of us know, by now, to clear cache and restart the browser, after updating a blog, for consistent testing. Some folks know that blog security changes don't always take complete and immediate effect.

Recently, we're seeing a new effect, reported by owners of Blogger accounts locked, after hacking activity is detected.
I got a message mentioning suspicious account activity, when I logged in to Blogger. I provided my phone number, and I received a code on my phone, that I had to enter before I could then log in. My blog was working fine just after I logged in. A short while later, though, it was gone. Why was my blog deleted, because I unlocked my account?
This blog owner is just slightly confused, about the cause and effect here.

Google robotic processes are constantly monitoring account login activity, and watching for signs of hacking activity, such as brute force password entry.

When hacking is detected, the detection may not be immediate - so Google protects us by considering the possibility that the hacking could have been successful, and deletes or locks blogs owned by the account under attack. The blogs in question are taken offline, immediately, when hacking is detected.

If a blog owner has just been working on a blog, as is frequently the case, the blog contents will be cached somewhere between the owner and the Blogger servers. Blogger can take the blogs offline, on their servers - but any cache containing the blogs will remain. If the blog owner is working on a blog while the Blogger account is under attack, what's in cache will remain, visible to the owner, until cache expires.

If a Blogger account is attacked, and the attack is detected, shortly after the owner has viewed a blog, what's in cache will be used, until it expires. The owner won't see the effects of the blog being deleted until the cache expires, and the browser tries to retrieve a fresh copy from the Blogger servers.

The blog owner sees the blog go offline shortly after he verifies account ownership, and thinks that the verification process caused the blog to go offline. In reality, the blog was taken offline before the owner even knew of "suspicious" account activity.

Now, the blog owner can do nothing, except wait until the account and the blogs are examined for signs of tampering. In some cases, no notification of progress will be received - and the owner will see the blog(s) returned to service, sometime later.

How much later the blogs return to service will vary widely, depending upon several details - and this variation, added to the uncertainty caused by cache latency, leads to mystery.

>> Top

Thursday, 21 February 2013

Malware Classification, And Country Code Alias Redirection Bypass Code

We're seeing a few complaints, in Blogger Help Forum: Something Is Broken, about overly aggressive malware classification, from blog owners who only want to publish their blogs without fear of side effects from the controversial feature, Country Code Alias Redirection.

Spurious malware / spam detection is a painful topic to discuss - and it's even more so when the question of country code alias redirection is discussed. Like auto pagination long ago, country code alias redirection appears to be another case of Google manipulating its customers, maliciously. If you consider this issue from the viewpoint of Blogger blogs in general, though, you may see the full picture.

Blogger blogs, like the Internet, need to be available to all countries in the world, without fear of censorship. Country Code Alias Redirection allows Blogger to selectively disable any single blog, in any single country. This selective disabling will, eventually, eliminate the need of any country government to block the entire Blogger service, in their country, because of a few unsuitable blogs.

Country Code Alias Redirection is a righteous feature in Blogger blogs. Like many new Google features, it was added before every Internet service was made able to support it. CCAR uses an Internet standard - not a Google proprietary feature - the canonical URL tag. If you look at the header in this blog, you can see an example of a canonical URL tag.
<link href='http://blogging.nitecruzr.net/2013/02/malware-classification-and-cc-alias.html' rel='canonical'/>
That's the tag for this article, for instance.

Some Blogger blog owners find that CCAR causes problems, with some accessories on their blog. Some owners have added anti redirection code to their blogs, so the accessories on their blogs continue to work. CCAR may not work with every third party provided blog accessory or Internet service - because all Internet services, and third party accessory providers, are not yet aware of canonical URL tags.

Just because some people are not up to date with all Internet features (like CCAR), this does not mean that CCAR should not be used. The people involved need to be encouraged to update their accessories, and their services, as necessary.

Right now, some blogs which include anti redirection code are being spuriously detected as malware hosts - and this is more controversy. The anti redirection code looks like malware, because similar code is used by people to abuse our blogs. To not classify blogs attempting to disable CCAR, would require the malware classifier to identify the intent of the blog owner - and would make malware detection more complicated.

Identification of intent is not present in computer software, right now. That ability will be available only when computers truly are programmed to "think" - and when that happens, it may be the end of the human race as we know it.

Since CCAR is a righteous feature, it's possible that anti redirection code actually should be treated as malware - even though the blog owners, adding the code to their blogs, may not consider this to be the case. Those of us who are concerned with detection and removal of malware and spam from the Internet, in general, know that malware and spam is like a cancer - if you don't remove what you see, it's only going to get worse.

To allow anti redirection code to be installed in some Blogger blogs, will encourage other blog owners to do the same. Also, it will allow some hackers and spammers to do likewise, without fear of detection. Neither of these possibilities is good for Blogger blogs, in general.

If you installed anti redirection code in your blog some time ago, your blog was just locked as a suspected malware host. and you are now anxiously waiting for malware review while your blog remains offline, we're sorry for you. But you are not being abused by Blogger - nor is your malware classification unfair.

Remove the anti redirection code, on your blog - now, while you are able. Encourage the providers of third party accessories and Internet services to update their code. And don't allow or encourage hackers and spammers to abuse Blogger blogs, or the Internet in general. Please.

>> Top

Tuesday, 12 February 2013

Blog Owners, Logging In To Blogger, Receiving Malware Warnings

We've been seeing a few problem reports, in Blogger Help Forum: Something Is Broken, from blog owners seeing malware warnings for unknown blogs or websites.
I get a warning from Google Chrome, when I login to Blogger.
Content from www.unknownblog.com, a known malware distributor, has been inserted into this web page. Visiting this page now is very likely to infect your computer with malware.
We know that our blogs are subject to malware and spam classification - but now we see that we can also get warnings for other blogs and websites, that we don't own.

A blog owner, seeing this warning when logging in, will probably find the source of the problem in the Reading List, where content from other people's blogs is routinely found. In some cases, the problem will be in blogs that are intentionally Followed, and blatantly contain malware - and in other cases, blogs that are intentionally Followed may be redirecting the post feed, in a vain attempt to extend their reader base.

In either case, the only solution is to identify the problem blog or website, by examining each individual Reading List entry, one by one, until the noted blog or website is found - then discontinue Following the problem blog or website.

One mysterious scenario can involve blogs using favicons which are detected as malicious, by image scanning malware protection - or which are hosted from a domain which is known for malicious activity. Favicons, tiny icons which represent a blog or website, are used to decorate blog headers and feed gadgets, and are sometimes served by third party services. A "malicious" favicon may be found on entries in the Reading List, or on entries in a bloglist, which will then affect our readers ability to view our blogs.

The bottom line here is that we are responsible for the content of the blogs and websites which we link to from our blogs - and which we Follow - as well as the content on our own blogs.

>> Top

Saturday, 9 February 2013

Deleted / Locked Blogs Have Several Causes, And Various Resolutions

Many blog owners are occasionally confused, by the effects of several Blogger / Google security processes, when they are simply trying to login to Blogger and work on their blogs. We see the agony, daily, in Blogger Help Forum: Something Is Broken.

The side effects of the security processes are similar - and depending upon various owner specific details, can be easily confused for each other. The possibility of confusion requires careful initial analysis, when we are faced with an angry blog owner.
My blog was deleted, by Blogger. How could they do this? I do not publish spam!
This is a typical problem report, which can reflect any one of the processes, each requiring different action in the forums.

There are various Blogger / Google security / TOS enforcement processes, each of which will cause a Blogger account and / or blog to be unavailable for full access, at any time.Each different process has a different effect on the Blogger account and blogs owned - and requires different attention by the blog owners, by the forum helpers, and by Blogger Support and Google Security.

DMCA Violation

Accounts and blogs can be deleted, for progressive DMCA violations.

The DMCA violation process originated with complaints made by the major entertainment industry content enforcement organisations, citing theft of "intellectual property" which they control. In the USA, this would involve the "MPAA" (Motion Picture Association of America), and the "RIAA" (Recording Industry Association of America). I have been told that similar content enforcement organisations exist in other countries.

In more recent events, private citizens have been known to use the DMCA Violation complaint process, for miscellaneous copyright violation reporting.

DMCA Violations have a formal complaint and appeal process.

Hacking detection

Blogger / Google network monitors are constantly analysing account login activity, and looking for signs of brute force password hacking. When hacking activity is discovered, the Blogger account - and all blogs owned by the account - are deleted and locked, pending account verification by the owner, and blog integrity checking by Google Security.

The blog owner, after changing the account password, solving a CAPTCHA, and / or verifying account ownership by providing various personal details, is left waiting for the blogs owned by the account to be examined for signs of abuse by the hacker. Until the blog(s) are returned to online status, they appear in neither the "Deleted blogs" or "Locked blogs" dashboard lists. The owner, even when logged in to the right Blogger account, simply sees the dashboard advice
You are not an author on any blogs.
In this case, neither the blog owner nor the forum helpers can do anything useful, except wait, anxiously - possibly, with no notice provided. The blog being offline may not be immediately observed by the owner - and this may cause more confusion.

Malware detection

Blogger robotic processes are constantly checking the various blogs, looking for malicious blog accessories, components, and scripts. When a blog is subject to "Malware" classification, the blog will appear in one of two dashboard lists, in sequence.
  1. Initially, the blog will appear in the "Deleted blogs" list. While the blog is in "Deleted" status, the blog owner will be able to do nothing, except request "Restore".
  2. Once the owner has requested "Restore", the blog is undeleted, and placed into the "Locked blogs" list. While the blog is in "Locked" status, all authors can access the blog to remove malware - but the blog remains offline, to all viewers. Once all malware has been removed from the blog, the owner can "Request Unlock Review".

If the blog remains in "Locked" status for over 48 hours, the blog owner may report this in the forums, and may request a manual review. The forum helpers, and online viewers, will generally see the blog displayed as "TOS violation".
This blog is in violation of Blogger Terms of Service and is open to authors only

Adult Content / Porn Detection

Blogger will soon classify and delete blogs with "adult content", which host advertisements to commercial porn sites. Like spam classification, this will probably involve both false negatives and false positives.

Spam detection

Blogger robotic processes are constantly checking the various blogs, looking for signs of spam activity and content. When a blog is subject to "Spam" classification, the blog will be displayed in the "Deleted blogs" dashboard list. The owner can do nothing, except request "Restore".

If the blog remains in "Deleted" status for over 48 hours, the blog owner may report this in the forums, and may request a manual review. The forum helpers, and online viewers, will generally see the blog displayed as "Removed".
Blog has been removed
Sorry, the blog at xxxxxxx.blogspot.com has been removed. This address is not available for new blogs.

Repeated Offenses

We have recently noted that repeated TOS Violations, involving DMCA, Malware, Porn, and Spam, are being dealt with in increasing severity.

Owner deletion or rename

Mistakes made by the owner can be confused with Spam detection. When a blog is deleted by the owner, it will appear in the dashboard "Deleted blogs" list for up to 90 days. During the 90 days, the owner (or a team member, when applicable) may "Restore" the blog. After the 90 days expire, the blog will be removed from "Deleted blogs", and will be unrecoverable. Besides being unrecoverable, no other details have been determined.

If the blog is renamed (published under a different BlogSpot URL), the external symptom may be similar to deletion by the owner.
Blog has been removed

Sorry, the blog at myblog.blogspot.com has been removed. This address is not available for new blogs.
In this case, the blog will be listed in the dashboard "My blogs" list, under the right Title. The owner needs to setup a stub blog, pointing the readers to the new URL.

Team Ownership

Any blogs owned by a deleted / locked Blogger account may simply disappear from the dashboards of other team members. If the Blogger account is not restored / unlocked, the blogs owned by that account - including any team owned blogs - may remain deleted - and inaccessible to everybody.

The Confusion Accumulates

Because of anonymous blog ownership, loss of account control, team blog ownership, and use of inactive or non existent email addresses, any account / blog which is deleted or locked for hacking (actively / as a victim), malware, and / or spam may not be easily discovered or recovered by the owner. These issues cause further confusion and frustration.

These scenarios may appear, to the untrained eye, to be signs of fraudulent, malicious, and / or petty actions by Blogger - and are loudly claimed so by spammers with their own agenda. None of these accusations are true - the above processes simply represent Blogger and Google attempting, in the best possible way, to protect everybody against the various hacking, malware, porn, and spam attacks which are constantly in progress.

>> Top

Thursday, 31 January 2013

Blogger Blogs And Commenting Permissions

Not all Blogger blog owners know that the ability to comment, like the ability to publish and read posts, is a privilege which they control - and a responsibility which they need to control, carefully.

Any blog owner who wishes to publish a blog, and not be subject to frequent deletion of the blog, as a suspected malware or spam host, needs to understand the responsibilities, and the risks.

There are levels of ability to post comments to a blog, which you select from the dashboard Settings - "Posts and comments" wizard. Protect yourself, if you allow comments.
  • Anyone - includes Anonymous Users.
  • Everybody with a Google, or an OpenID, account.
  • Everybody with a Google account.
  • Blog members only.
  • Comments disabled.
Choose this setting with great care.

If you allow comments by "Anyone", prepare to deal with the spam. Note that anonymous users can post either anonymously, or using "Name / URL" tags, at their discretion, with "Anyone" selected. "Name / URL" does not provide authentication. "Anyone" means anyone, period.

Besides "Who can comment?", you may also control comment publishing using CAPTCHA (aka "word verification") screening, and using comment moderation. These settings, like "Who can comment?", are part of the Settings - "Posts and comments" wizard.

Every blog owner, hoping for any visibility in the Blogosphere, needs to choose these settings carefully - or risk being buried by spam.
  • Who can comment?
  • Comment Moderation.
  • Comment Notification Email.
  • Show word verification

Comment Moderation, and Comment Notification Email, together, provide 2 settings which can bury your email Inbox, depending upon activity of commenting on your blog. Choose these settings wisely.

If you allow spam comments without control, you may later find yourself asking for help, in Blogger Help Forum: Something Is Broken
Help me! My blog was deleted by Blogger!
Protect your blog, and your blog's future, by allowing comments, responsibly.

>> Top

Be Aware When You Install Third Party Code On Your Blog

We've been seeing a few problem reports, in Blogger Help Forum: Something Is Broken, from blog owners who are not aware of the risks from installing third party code, on their blog.

Some blog owners are not even aware that the code being installed is not supplied by Blogger - and is not subject to the same coding standards as code supplied by Blogger.

Third party accessories and code - from simple JavaScript that installs in the blog template, to attractive XML gadgets installed using the "Add a Gadget" wizard - has always been a challenge, to Blogger blogs. Knowing when you are installing code provided by someone other than Blogger / Google, and taking appropriate precautions, is your responsibility.

Blogger provides a large library of XML coded accessories, installed using the Layout "Add a Gadget" wizard.

As we have learned in the past, however, the "Add a Gadget" accessory library is also used for distribution of non Blogger supplied gadgets. Gadgets supplied by Blogger are available using "Add a Gadget", and are labeled "By Blogger". Google does have other accessory libraries - the late "iGoogle" library is one well known one. That aside, most Blogger blogs - and all non Google websites, which are used for distribution of Blogger accessories and gadgets - are non Blogger products.

Be aware of what you are about to install, on your blog.
  • A gadget provided using "Add a Gadget", and labeled "By Blogger" is a Blogger provided gadget.
  • A gadget provided using "Add a Gadget", but not labeled "By Blogger", is not a Blogger provided gadget.
  • A gadget provided using a Blogger blog, which is not published by Blogger, is not a Blogger provided gadget.
  • A gadget provided using a non Google website is not a Blogger provided gadget.

These are examples of Blogger supplied gadgets. Anything different is not a Blogger supplied gadget.

If you install non Blogger code in the template, and later see
Your blog has been deleted because of MALICIOUS JAVASCRIPT
this is a risk which you take.

Do not install non Blogger code on your blog, without knowing the risks.

>> Top

Monday, 28 January 2013

Country Code Aliases Cannot Be Bypassed, Productively

Occasionally we see the innocent query in Blogger Help Forum: Something Is Broken, about the recently introduced Blogger feature - country code aliasing.
Is there any way I can opt out from this constantly changing of the .com termination, into .be, .bg, or .ro, depending on where I travel?

Not many Blogger blog owners realise the benefits of country code aliasing, which is, like auto pagination, a feature which is not optional. There are publicly available workarounds, which may bypass the effects of country code aliasing - and which may cause more trouble than simple URL confusion.

Many spammers would love to setup gateway blogs, and automatically redirect their unwitting victims to other blogs (or non Blogger websites) which contain their actual hacking, porn, or spam payload. Blogger / Google, like some browsers and security programs, actively prevents automatic redirection of Blogger blog traffic.

Not all blog owners understand the effect of Blogger malware classification. Similar to spam classification, malware classification actively scans through Blogger blogs, looking for signs of malware. Here's an example - a very simple code snippet, recently discovered in the header of the template, in a blog which has been repeatedly locked for "Malicious JavaScript" / "Spam".
var·blog·=·document.location.hostname;
var·slug·=·document.location.pathname;
var·ctld·=·blog.substr(blog.lastIndexOf("."));
if·(ctld·!=·".com")·{
var·ncr·=·"http://"·+·blog.substr(0,·blog.indexOf("."));
ncr·+=·".blogspot.com/ncr"·+·slug;
window.location.replace(ncr);
}
To prevent malware detection here, I'm omitting the essential opening and closing tags, which would normally encase the code snippet.
<script·type='text/javascript'> ... </script>

If your blog contains similar redirection code, to bypass country code aliasing, you may get a notice, one day, that your blog has been deleted for "Malicious Javascript". In order to get the blog restored, so your readers may view it, you may have to remove the Malicious JavaScript - then wait until the blog can be reviewed, to ensure that it is safe for public visibility.

You will accomplish more, and cause yourself (and your readers) less pain, by learning to live with country code aliasing - and concentrating on convincing the various search engines and other Internet services to accept Canonical URLs, so country code aliasing will work, seamlessly, with the Internet service which interests you. Alternately, use better designed gadgets and Internet services.

>> Top

Saturday, 19 January 2013

Blogger Cannot Provide Advance Warning Of Malware / Spam Hosting Deletions

One of the more intriguing tales, in the never ending saga of malware and spam interdiction, would have to be the confusion about the proper procedure for deleting or locking blogs, when suspected of hosting malware or spam. We periodically see, as part of a "Please unlock my blog!" request in Blogger Help Forum: Something Is Broken, the naive suggestion.
It would be better if Blogger Support had immediately alerted me of this problem, before deleting my blog!
The irony here is that, from a purely "customer service" viewpoint, I have to concur with the principle here.

It would be better, if Blogger Support could do this. Like many "it would be better" observations, this is probably never going to happen.

What would happen, if Blogger were to provide advance notification of any malware / spam classification? Many spammers would certainly appreciate this option - to remove the dodgy content, before the blog is deleted or locked. The typical spammer would have several options.
  1. Remove the dodgy content, immediately.
  2. Copy the entire blog to a second blog in the spam blog farm, and wait until receiving advance notification for that blog. Lather, rinse, repeat.
  3. Possibly, do nothing. Later, claim indignantly
    I never got the notification!
    and hope that the kind souls at Blogger Support would give him another chance, since he had not been properly warned.

Option #1, used wisely, could even be used to "map" out the current spam mitigation strategy, and let spammers publish hundreds of spam blogs, staying below the radar. Essentially, we would see self whitelisting of spammy blogs. What spammer would not go for that, in a second?

Besides the spammers benefiting hugely from advance notification, not all genuine blog owners would benefit. Not every blog owner uses a properly registered Blogger account, or will read email from Blogger Support.

So, we have two downsides to the option of advance notice.
  • Spammers would love it.
  • Not every non spammer would appreciate it.
I, for one, don't see an upside - or certainly not any upside with benefit to counter the downsides.

In Utopia, there would be no spammers, and no need for any of this. Unfortunately, the Internet will never be part of Utopia.

>> Top