Someone is inserting ads into my Firefox Google SERPs
June 3, 2012 7:22 PM Subscribe
Something is hijacking my Firefox and stealthily inserting ads into my Google SERPs (and god knows what else). How do I figure out where its coming from?
I noticed not too long ago that when I'd search for something on Google, the ads wouldn't display immediately at the top, and when I'd go to click something up there, or after a brief delay, they would pop in.
Now, I manage paid search at an agency for a living so I was wondering if this is something new Google was testing--they test this kind of thing all the time. I could see them testing that because it was timed in a way that would increase the rate of accidental clicks on ads.
But then I noticed something...the URLs were odd.
In Chrome, when I search for say, "lawnmowers" I get the following from one of the ads:
http://www.google.com/aclk?sa=L&ai=C9MZ2-BjMT86vNuSZsgKV__j6BvGJmOkDkZeF4FGqotYHCAAQAygDUO3p58UHYMmG_4fwo-wSyAEBqgQcT9DJnjpJ_Vn8luLujYZ9QimnmQr1PhzoXAMsKw&sig=AOD64_02j6mNPV2dJmzXIozqtZwpup40Tw&ved=0CB4Q0Qw&adurl=http://www.homedepot.com/Outdoors-Outdoor-Power-Equipment-Riding-Mowers/h_d1/N-5yc1vZbxcf/h_d2/Navigation%3FcatalogId%3D10053%26cm_mmc%3DSEM%7CTHD%7CG%7CSTO%7CDSK%7CD28I%7CLawnMowers%7CTractors%26skwcid%3DTC%7C14776%7Cyard%2520tractors%7C%7CS%7Cb%7C21840481289&rct=j&q=lawmowers
However in Firefox, where I've been noticing the issue, I instead get the following:
http://google-co.com/xml/click/?m=60860&f=444184&r=748108021&p=0&h=homedepot.com
A little sleuthing shows the following info for the google-co.com domain:
Registrant:
DDD
230 4 st
ny, ny 10012
US
Domain name: GOOGLE-CO.COM
Administrative Contact:
davis, danny
230 4 st
ny, ny 10012
US
+1.8776936215 Fax:
Technical Contact:
davis, danny
230 4 st
ny, ny 10012
US
+1.8776936215 Fax:
Registrar of Record: MISK.COM
Record last updated on 2011-Dec-19.
Record expires on 2014-Dec-19.
Record created on 2011-Dec-19.
Domain servers in listed order:
NS.WEBAIR.NET
NS2.WEBAIR.NET
I sent this person a somewhat casual email saying I'm an internet marketer and was curious how he was doing that--don't expect a response though.
In any event, clearly NOT Google. So how do I trace what is happening here and figure out where it is coming from? Spybot didn't find anything...
I noticed not too long ago that when I'd search for something on Google, the ads wouldn't display immediately at the top, and when I'd go to click something up there, or after a brief delay, they would pop in.
Now, I manage paid search at an agency for a living so I was wondering if this is something new Google was testing--they test this kind of thing all the time. I could see them testing that because it was timed in a way that would increase the rate of accidental clicks on ads.
But then I noticed something...the URLs were odd.
In Chrome, when I search for say, "lawnmowers" I get the following from one of the ads:
http://www.google.com/aclk?sa=L&ai=C9MZ2-BjMT86vNuSZsgKV__j6BvGJmOkDkZeF4FGqotYHCAAQAygDUO3p58UHYMmG_4fwo-wSyAEBqgQcT9DJnjpJ_Vn8luLujYZ9QimnmQr1PhzoXAMsKw&sig=AOD64_02j6mNPV2dJmzXIozqtZwpup40Tw&ved=0CB4Q0Qw&adurl=http://www.homedepot.com/Outdoors-Outdoor-Power-Equipment-Riding-Mowers/h_d1/N-5yc1vZbxcf/h_d2/Navigation%3FcatalogId%3D10053%26cm_mmc%3DSEM%7CTHD%7CG%7CSTO%7CDSK%7CD28I%7CLawnMowers%7CTractors%26skwcid%3DTC%7C14776%7Cyard%2520tractors%7C%7CS%7Cb%7C21840481289&rct=j&q=lawmowers
However in Firefox, where I've been noticing the issue, I instead get the following:
http://google-co.com/xml/click/?m=60860&f=444184&r=748108021&p=0&h=homedepot.com
A little sleuthing shows the following info for the google-co.com domain:
Registrant:
DDD
230 4 st
ny, ny 10012
US
Domain name: GOOGLE-CO.COM
Administrative Contact:
davis, danny
230 4 st
ny, ny 10012
US
+1.8776936215 Fax:
Technical Contact:
davis, danny
230 4 st
ny, ny 10012
US
+1.8776936215 Fax:
Registrar of Record: MISK.COM
Record last updated on 2011-Dec-19.
Record expires on 2014-Dec-19.
Record created on 2011-Dec-19.
Domain servers in listed order:
NS.WEBAIR.NET
NS2.WEBAIR.NET
I sent this person a somewhat casual email saying I'm an internet marketer and was curious how he was doing that--don't expect a response though.
In any event, clearly NOT Google. So how do I trace what is happening here and figure out where it is coming from? Spybot didn't find anything...
It's one of your addons, probably IE-Tab-Plus.
Tools -> Addons and remove it.
posted by mhoye at 7:34 PM on June 3, 2012 [1 favorite]
Tools -> Addons and remove it.
posted by mhoye at 7:34 PM on June 3, 2012 [1 favorite]
Response by poster: And I think I found the answer...looks like IE Tab Plus might be the culprit. So much for Mozilla security...
posted by Elminster24 at 7:34 PM on June 3, 2012
posted by Elminster24 at 7:34 PM on June 3, 2012
I've logged this as Bug 761050 in Mozilla's bug tracker, and it looks like it's being cc'ed to the right people.
posted by mhoye at 7:22 AM on June 4, 2012
posted by mhoye at 7:22 AM on June 4, 2012
This thread is closed to new comments.
posted by Elminster24 at 7:22 PM on June 3, 2012