what's your website?
https://propertyengine.co.uk
It's plausible that it's being naively flagged as something like phishing/misrepresentation of the ".com" site using that name.
Ask HN: Google Ads Rejected My SaaS as Compromised Site
21–30 of 64 posts
Re: Ask HN: Google Ads Rejected My SaaS as Compromised Site
#22This happens fairly often. But honestly it's a bit ridiculous that Google suggests that you change from a .co.uk to a .com to resolve the issue. That is NOT an option unless they're going to pay for the domain and the domain migration.
I would keep pushing back on that, there is no way that you need to move to another TLD.
They say that the site is "compromised and has malicious software", I bet it's actually something else, like a site that you're linking out to that's compromised and malicious--that's happened quite a bit in cases where sites are flagged like this in Google Ads.
Re: Ask HN: Google Ads Rejected My SaaS as Compromised Site
#23Earlier quoted context omitted.
https://propertyengine.co.uk
It's plausible that it's being naively flagged as something like phishing/misrepresentation of the ".com" site using that name.
Hmm possibly, good idea. That's a different company based in SA in a different space, but maybe you're right.
Re: Ask HN: Google Ads Rejected My SaaS as Compromised Site
#24It's not the same thing, but it's still Google, soo.... all three of my kids are on school or club sports teams that use Teamsnap ( https://www.teamsnap.com/ ) for coordination. This includes exposing calendar subscriptions to Google Calendar and delivering messages & event/change notifications via email (and push notification via the mobile app). For some reason, Gmail has decided that Teamsnap is no longer a truste…
Reputation is crowdsourced. Perhaps at some point Teamsnap lost control of their infra and sent out a bunch of malware. Why do you assume the mistake was Google's? Same question for the OP. If Google was trying to tell me my site was compromised the first course of action I would take is to have a look into that, or page secops, before that situation spreads further.
Re: Ask HN: Google Ads Rejected My SaaS as Compromised Site
#25Do you get flagged in any databases here : https://www.ssltrust.com.au/ssl-tools/website-security-check
As I know google is partnered with a lot of them and if your flagged in one you’ll need to contact them to get removed.
Re: Ask HN: Google Ads Rejected My SaaS as Compromised Site
#26Do you get flagged in any databases here : https://www.ssltrust.com.au/ssl-tools/website-security-check As I know google is partnered with a lot of them and if your flagged in one you’ll need to contact them to get removed.
Thanks, seems to be all clean
https://www.ssltrust.com.au/ssl-tools/website-security-check...
Re: Ask HN: Google Ads Rejected My SaaS as Compromised Site
#27This happens fairly often. But honestly it's a bit ridiculous that Google suggests that you change from a .co.uk to a .com to resolve the issue. That is NOT an option unless they're going to pay for the domain and the domain migration. I would keep pushing back on that, there is no way that you need to move to another TLD. They say that the site is "compromised and has malicious software", I bet it's actually somethi…
The logical thing to do would be to provide that feedback as part of the assessment, if they're linking to a compromised site. Even that seems flawed, however. If OPs site is marked as compromised (and isnt) and someone links to it, will they then also be denied access to advertising because their site is now compromised? Soon thereafter I imagine that we have a runaway cascade and everyone is "compromised".
Re: Ask HN: Google Ads Rejected My SaaS as Compromised Site
#28It's not the same thing, but it's still Google, soo.... all three of my kids are on school or club sports teams that use Teamsnap ( https://www.teamsnap.com/ ) for coordination. This includes exposing calendar subscriptions to Google Calendar and delivering messages & event/change notifications via email (and push notification via the mobile app). For some reason, Gmail has decided that Teamsnap is no longer a truste…
Reputation is crowdsourced. Perhaps at some point Teamsnap lost control of their infra and sent out a bunch of malware. Why do you assume the mistake was Google's? Same question for the OP. If Google was trying to tell me my site was compromised the first course of action I would take is to have a look into that, or page secops, before that situation spreads further.
After years of similar issues, why are you giving them the benefit of the doubt? Especially if they won't explain what the issue is and gave out such ludicrous advice to the OP?
Re: Ask HN: Google Ads Rejected My SaaS as Compromised Site
#29This happens fairly often. But honestly it's a bit ridiculous that Google suggests that you change from a .co.uk to a .com to resolve the issue. That is NOT an option unless they're going to pay for the domain and the domain migration. I would keep pushing back on that, there is no way that you need to move to another TLD. They say that the site is "compromised and has malicious software", I bet it's actually somethi…
The logical thing to do would be to provide that feedback as part of the assessment, if they're linking to a compromised site. Even that seems flawed, however. If OPs site is marked as compromised (and isnt) and someone links to it, will they then also be denied access to advertising because their site is now compromised? Soon thereafter I imagine that we have a runaway cascade and everyone is "compromised".
> Soon thereafter I imagine that we have a runaway cascade and everyone is "compromised".
The web isn't as well woven as it used to be. They'll just harm a bunch of innocent people, not numerous enough for the public at large to even notice.
Re: Ask HN: Google Ads Rejected My SaaS as Compromised Site
#30Couple of things you can check:
1. See if VirusTotal lists your site (including subdomains, app.domain and www.domain, etc): https://www.virustotal.com/gui/home/url
If wrongly flagged, reach out to each security vendor manually - takes about 3-5 days to get them to rescan manually and remove any flags.
2. Check for any dodgy javascript libraries you might inadvertently be using. Specifically, just remove all non-relevant JS until you get approved, then you can slowly add them back in if really needed.
Super frustrating that Google has this much power, and totally ridiculous they want you to switch to .com (pretty sure that's an outsourced CS worker giving you a random suggestion).