Custom Domain Migration, And Redirection Blocking

We see occasional frustration, in Blogger Help Forum: Get Help with an Issue, involving broken or unreliable custom domains.

I setup the Custom Domain properly, following the Google directions.

For some of my readers, my custom domain is not opening. I can see it is going in an infinite loop in the browser - and after a long time, it's throwing errors. My domain is setup, properly. Why do I have to deal with this?

And we will investigate - and in many cases, we find the domain is setup properly.

Some custom domain published blogs have problems, which have nothing to do with the domain setup.

Some custom domain problems involve custom code, added to the template, long ago.

Not everybody is in favour of the ongoing Blogger efforts to convince blog owners to force their readers to use HTTPS / SSL, in blog access.

A number of hackers are making their websites popular, by providing code that lets blogs block forced HTTPS access - just as they provided code that blocked local country domain redirection. Some blog owners add this dodgy code, to their blogs.

This hacking lets blog owners publish their blogs, and use accessories and gadgets that only support HTTP access. Unfortunately, with third party code, you get what you get.

Some third party code, which blocks HTTPS blog access, works OK - for a while.

When a blog is published to a custom domain, redirection to "blogspot.com" causes a redirect loop - or a security check.

<script type='text/javascript'>
var blog = document.location.href.toLowerCase();
if (!blog.match(/\.blogspot\.com/)) {
  blog = blog.replace(/\.blogspot\..*?\//, ".blogspot.com/ncr/");
  window.location.replace(blog);
  }
</script>

This is clever code, seen some time ago when used to block country local domain redirection. Then, as now, some blogs might be deleted or locked as malware hosts - or the blogs would become intermittently inaccessible.

Is the unreliability appropriate? You can add what code you like, to your blog. Eventually, what you add may cause you problems.

---

Some #Blogger blog owners add clever code, to block HTTPS Redirection, to their blogs. This is the same hacker provided code, used long ago to block local country domain redirection.

Like country domain redirection, the code added may work fine, for a while. Eventually, the blog will be deleted / locked for malware hosting - or will start throwing 404 errors and similar confusion.

https://productforums.google.com/forum/#!category-topic/blogger/71k8xOXxByI

Is There A Purpose To Referer Spam?

We've been experiencing - and discussing - referer spam, since 2011.

We still see unaware blog owners, asking in Blogger Help Forum: Get Help with an Issue.

When I checked my stats for my blog, and looked at traffic sources, I noticed a link from a different country - and it just seems weird that Russian readers would then go to a US site.

When we explain that they're probably seeing another referer spam attack - and that clicking on the links is not always a good idea, we get a variety of responses. Some want to know if there is a purpose, to this noise.

Referer spam has a variety of purposes - ranging from commercial, to dangerous, to deceptive.

Garbage? Or a purpose?



Here are just 3 examples, from Blogger Help Forum: Get Help with an Issue.

• Advertise any paying customer.
• Lead you to a website with hacking content.
• Attack innocent third parties.

Advertise any paying customer.

This is the commercial possibility. If there's money to be made from publishing informative, interesting, and original content, there is probably lots more money to be made herding innocent third parties to ads on any website needing traffic - and lacking informative, interesting, and original content.

This may even represent a variation of GPT. And with the volume of referer spam that's possible, there are surely enough naive blog owners to make this a very lucrative activity.

Lead you to a website with hacking content.

This is the dangerous possibility. With hacking activity as a possible destination, clicking on a Stats link blindly is like playing "Russian Roulette", with your computer.

And, don't expect the website URL to provide a clue as to the destination. "www.innocous-name.com" could itself be hacked - and might unknowingly serve content from "www.hacking-website.com" - or redirect to "www.hacking-website.com".

Attack innocent third parties.

This is the deceptive possibility.

My blog was a "victim" of referer spam attack, in 2011. I have seen similar referer spam reports, that suggest this is not an unusual use of referer spam.

Protect yourself - if you must investigate your referers.

Surely, there are still actual people surfing - and some referer links are genuine. Eventually, you will want to check out some of the more intriguing URLs, in "Traffic sources".

If you decide to investigate one of the links, copy the text of the link URL - then use a proxy server.

Just don't investigate links, without protection. That's what proxy servers are for.

---

Some #Blogger blog owners want to know if referer spam has a purpose - or if it is simply random noise. It actually has a variety of purposes - commercial, dangerous, and deceptive.

Blogger Magic - Add An HTML Gadget

Many popular accessories start with raw HTML / JavaScript code, from different third party services.

One of the advantages of publishing a Blogger blog is the abundance of available accessories. With Blogger being in the top 3 of Internet publishing platforms, every third party service wants customers who publish using Blogger.

There are plenty of abusive or malicious accessories, that should not be installed, even when offered - and there are ways to best install the accessories, that can be safely installed.

Most accessories, from third party services, will be provided as HTML / JavaScript.

To add HTML / JavaScript code, to a blog, you can use any of several techniques - though using a new HTML / JavaScript gadget is the smartest choice. Adding an HTML gadget, to a Blogger blog, is not difficult.

Add an HTML / JavaScript gadget, using "Add a Gadget" in Layout.

1. Start from the "Layout" dashboard menu page.
2. Click "Add a Gadget".
3. Click the "+" button, for "HTML/JavaScript".
4. Paste the code, given to you, into the "Content" box.
5. Click "Show HTML/JavaScript", if the option is provided.
6. Click "Save".
7. Position the new gadget anywhere in the Layout display.
8. Click on "Save arrangement".

Start from the dashboard Layout page, and select any convenient link to "Add a Gadget". Select "HTML/JavaScript" from the "Basics" tab, in the "Add a Gadget" wizard.

Select "HTML/JavaScript" in "Basics".



Paste the code, that you have to add, into the "Content" window, in the "Configure HTML/JavaScript" wizard. And if you wish, give your new gadget a Title.

Paste the code that you have, into "Content" - with the wizard in HTML mode ("Rich Text" displayed).



And select "Show HTML/JavaScript", if provided for this template - then click on "Save". Finally, click on "Save arrangement".

Avoid several well known mistakes, when adding gadgets.

There are mistakes, that you can avoid - if you know what to do.

• Be selective, when adding third party code.
• Add a gadget, using "Basics".
• Edit an HTML gadget, with "Rich Text" displayed as the caption (for HTML) - or with "Edit html" displayed as the caption (for Rich Text).
• With a dynamic template, attach or embed the content in a static page.
• With a mobile display, enable the gadget, if you want it to be viewed.
• With templates that have a disappearing sidebar, position the gadget in the footer.
• If "Show HTML/JavaScript" is provided for this template, select that option.

Be selective, when adding third party code.

It's your blog - and you are allowed to install any accessories and tweaks that interest you. For long term stability and success, though, you should try to only install code from reliable sources.

Your readers will be happier, with your blog using reliable accessories.

Add a gadget, using "Basics".

You'll start with an "Add a Gadget" link, on the dashboard Layout page - and the "Add a Gadget" wizard.

The "Add a Gadget" wizard has the "Basics" tab, with the "HTML / JavaScript" gadget in the list - and it has the "Add your own" tab. You should find the "HTML / JavaScript" gadget, in "Basics".

Edit an HTML gadget, with "Rich Text" / "Edit html" displayed as the caption.

The "HTML" / "Text" gadgets, intriguingly have the "Edit Html" / "Rich Text" tabs.

If you want to add / edit HTML or JavaScript, the caption should read "Rich Text".



The HTML gadget, in HTML mode.



Conversely, if you want to add / edit text, the caption should read "Edit html".

It's your choice. The "HTML / JavaScript" and "Text" gadgets are the same - just the captions ("Edit html" and "Rich Text") differ.

With a dynamic template, attach or embed the content in a static page.

Adding gadgets to dynamic templates is not a straightforward process. Gadgets have to be written specifically to support dynamic templates - and the HTML gadget is not written for this.

If you want an HTML gadget to work in a dynamic template, you'll need to attach or embed the gadget, in a static page.

With a mobile display, enable the gadget, if you want it to be viewed.

By default, the "HTML / JavaScript" gadget does not display, on a mobile browser. You will have to use the Template Editor, and enable the gadget to display, in mobile mode.

With templates that have a disappearing sidebar, position the gadget in the footer.

Some Responsive class templates have a sidebar that is hidden by default. To see the sidebar, you click on the "hamburger" icon in the header.

If you want your new gadget to work with the blog loaded - even without the sidebar showing - you need the gadget in a visible section. The footer is a better choice, in this case.

If "Show HTML/JavaScript" is provided for this template, select that option.

If the option to "Show HTML/JavaScript" is provided in the "Configure HTML/JavaScript" wizard, be sure to select that - if you want the gadget to operate, with the blog loaded. If the gadget should not be visible to the reader, but it needs to operate, you still must enable this option.

It's your blog.

There are ways to make an HTML gadget work, while ignoring the above advice. Long term success will be much more likely, though, with attention to the details.

---

One of the most common accessories, added to a #Blogger blog, starts with an HTML / JavaScript gadget. This is a very versatile gadget - and it's not difficult to install. There are several common sense details, however.

Blogger Support Won't Play Wheel Of Fortune With Us

Long ago, Blogger Support used to provide personalised account recovery service, to blog owners who had forgotten their account names and passwords - and give "hints" in open forum discussion, reminiscent of the popular TV game show, Wheel Of Fortune.

But reality intervened - and now, everybody who wants to recover access to a Blogger account / blog must use one of the automated account / blog access recovery tools- ignoring however defective they may appear to be.

We have seen several sad stories, played out in Blogger Help Forum: Get Help with an Issue.

Round #1

An unhappy "blog owner" would request assistance.

I forgot the password. Can somebody help me recover access?

Blogger Support would email recovery instructions to "whatever @ gmail . com", and advise the "blog owner"

I emailed your reset instructions to "w****** @ g**** . com".

Sometimes they would get the reply

That does not help me. Can I buy a vowel?

Blogger Support, always optimistic, would give it another go.

I emailed your reset instructions to "w***e*** @ g**** . com".

then

I emailed your reset instructions to "w*a*e*** @ g**** . com".

finally

I emailed your reset instructions to "w*a*e**r @ g**** . com".

Finally, the successful "blog owner" would reply

Thank you so much! I am so happyyyyyyyy!!!

But the story did not always end there.

Round #2

The next month somebody would report

My blog disappeared from my dashboard while I was in the hospital, in a coma. I now want to tell everybody how I am doing - but my blog is now full of spam, and nobody can read it!! Whatever can the problem be?

And the blog mentioned in Round #2 turned out to be the same as in Round #1.

Round #3

The final verdict would be that Blogger Support, while playing "Wheel of Fortune" in Round #1, had been playing with a hacker, who was then able to steal somebody else's blog.

Bonus Round

After that happened a couple times. Blogger developed the recovery tools, and wrote the final FAQ. And, stopped providing real time, personalised advice.

And that is that. You cannot prove that you are the owner of the blog, because you cannot communicate directly with Blogger Support. You have to use the tools provided - and / or search each email account, persistently.

Blogger Support will not play "Wheel of Fortune" any more. Everybody is urged to never reveal their email address, to the world.

In some cases, the blogs would be deleted, as new spam hosts - but ownership is seldom recoverable.

Bankrupt

Your best solution, now, is to start a new blog - then combine the two blogs, in a blog cluster.

Use Common Sense, And Protect Your Blog

We see various questions about getting advice and non standard accessories / code, from blogs and websites advertised outside Blogger / Google control - generally in Blogger Help Forum: Get Help with an Issue.

Why can't I see my blog? Every time I click on "View blog", I get a face full of ads!

and

Where can I get accessories, gadgets, and templates for my blog??

and

How do I know what accessories, gadgets, and templates are safe, for my blog?

and

Why did Blogger lock my blog, as a malware host?

All of these folks are discussing the same issue - blog content security. Some are asking properly, before they cause their problems - but others are not.

We have several known bad actors, right now - who have been putting out various blog accessories which, initially, work fine.

After thousands of victims have installed some accessories on their blogs, the owners and readers observe that the blogs are suddenly redirecting to advertising pages, or throwing popup ads on top of blog content. The latency period, for some blogs which are the first to install a new hacker provided gadget, may be as long as 6 months to a year.

By the time any malicious gadgets are discovered, identified, and removed, the victims have to deal with unhappy readers, who don't enjoy seeing a screen full of ads, instead of their favourite blog to read.

Search engine reputation is also affected by this problem. In some cases, the malicious gadgets may be detected by Blogger - and the host blog (ie, your blog) is locked, as a suspected malware host. Even if Blogger does not detect a problem, services outside Blogger will trash your blog.

Thoughtful blog owners will ask how they can get good, reliable, and safe blog accessories. I would start, by ranking the possibilities.

1. Blogger "Add a Gadget", with gadgets labeled "By Blogger".
2. Websites provided by well known Internet services.
3. Blogger "Add a Gadget", with gadgets not labeled "By Blogger".
4. Non Blogger websites provided by developers.
5. Non Blogger websites provided by hackers and spammers.

1. Blogger "Add a Gadget", and gadgets labeled "By Blogger".

The most reliable and safe gadgets will always be found in the "Add a Gadget" library, and be labeled "By Blogger". You have to trust Blogger, if you are going to use their publishing platform in general.

The optional gadget library, and gadgets "By Blogger", is just as safe as the dashboard, and components referenced by the dashboard.

2. Websites maintained by well known Internet services.

Most well known Internet services and social networking platforms will provide gadgets that are designed for Blogger. The best gadgets will be labeled "For Blogger", and be written in Blogger compatible XML. Some general purpose gadgets, written in HTML / JavaScript, will also be suitable.

Almost any gadget in this category, if written by the staff of the service in question, will be free from malicious intent. Both FaceBook, and Twitter, for instance, provide gadget libraries. Because these gadgets were not written by Blogger staff, they will not be as reliable as Category #1.

3. Blogger "Add a Gadget", and gadgets not labeled "By Blogger".

Many gadgets provided in "Add a Gadget" will be provided by third party developers. Hopefully, Blogger / Google exercises some quality control, over gadgets distributed through their library.

That said, the first mass hacking of Blogger blogs, of 2009 - 2010, came through gadgets that were distributed from the "Add a Gadget" libraries. One such gadget was discovered, just last week.

Not all third party accessories are provided with malicious intent. Unfortunately, even if not provided maliciously, some accessories may be unreliable because of periodic changes by Blogger.

4. Non Blogger websites provided by developers.

After the unforgettable blog hijacks of 2009 / 2010, then 2010 / 2011, Blogger / Google Security got aggressive with the problems of malicious gadgets being served from their libraries. Most recent hacking attacks have been distributed from websites outside the control of Blogger / Google.

Some non Google websites are provided by third party developers, who write code almost as reliable as Blogger staff. However, if the choice for my blog was between gadgets in Categories #3 and #4, and be of equal functionality and suitability, I would choose #3 over #4 - and I would seriously recommend the same, if asked.

In some cases, legitimate third party developers have provided accessories that require access to their code libraries. The developers have gone out of business, and have cancelled the domains where the code libraries were served. The abandoned domains have been bought by spammers, as investments - based on serving ads to accumulated incoming traffic, from people surfing to the blogs and websites which have the accessories installed.

In some cases, the domains were actually abandoned by the developers. In other cases, the developers were spammers, who sold their domains for a good profit, to other spammers.

We, the blog owners, cannot really tell which case is involved, when our blogs start redirecting to pages of spam - or even malicious domains, serving malware to our readers. We do need to protect our readers, though.

5. Non Blogger websites provided by hackers and spammers.

Some websites outside the control of Blogger / Google should not be trusted. I would seriously suggest without hesitating, that you stay away from websites like "SEOYourBlog.com", "MakeMunyFromHome.info", and such.

Any blog or website, with clever initials in the name, should be considered, with great caution. Although "SEO" was originally a serious concept, most websites with "SEO" in the name will not have your best interests in mind. Likewise "GPT, "PTC", "PTS" will do you no good.

If and when you add gadgets, always add them using a new HTML / JavaScript gadget. Gadgets added using "Add a Gadget" can be easily removed, if they go bad. Gadgets added using "Edit HTML" must be removed using "Edit HTML" - and some gadgets will be extremely challenging to diagnose and remove.

Security begins with you.

Comments Posted Use "noreply" Email Addresses

Recently, we've noted a number of complaints about Blogger commenting, in Blogger Help Forum: Something Is Broken

.My comments all use a "noreply" email address, instead of my actual email address. How do I have people email their replies to my comments?

This appears to be one more way which Blogger is trying to safeguard our Blogger accounts and blogs, from malicious, technically astute blog thieves.

Some time ago, we observed that this precaution appeared to be unique to Blogger accounts which used Google and Google+ profiles - and did not involve Blogger profiles.

It appears that this is now universal, and includes Blogger profiles, as well as Google / Google+ profiles. It's likely that the noreply email addresses are being offered to keep more blog readers from, inadvertently, exposing their email addresses to email mining techniques.

In remembering the long ago discovered "nice blog" spam, it's possible that "nice blog" spam was originally developed to help the spammers gather email addresses, using very innovative technique.

All that a spammer has to do is to post a "nice blog" comment, select "Email follow-up comments to me" - then watch as the Inbox fills up with follow up comments from bloggers, willingly giving up their email addresses to every stranger also selecting "Email follow-up comments to me", in that comment thread.

The people willingly providing their email addresses, to the world in general, are perfect targets for hackers later trying to brute force access to the Blogger accounts, starting from the provided email addresses. Use of the "no-reply" email address prevents this type of mischief - and reduces the workload of Google Security, as they would otherwise have to verify account / blog integrity, for hacked accounts and blogs.

For even more protection (which is not a bad idea, in any case), consider using Google 2-Step Verification, to protect your Blogger / Google account from hacking.

>> Top

Blogger Is Unfair - To Would Be Blog Thieves

Blog owners continue to forget the account name and / or password of their Blogger accounts, then demand alternate recovery options.

Every week, we see the reports in Blogger Help Forum: Get Help with an Issue, claiming that changing their email - or getting a new phone - caused somebody to unfairly lose access to her / his blog. Too many blog owners refuse to understand that the email address and phone number are simply backdoor accesses to their Blogger accounts.

When given advice to use Blogger: Forgot your username or password?, or Blogger Help: Having trouble signing in or viewing your blog?, we frequently see demurrer.

Neither tool helps me. Can I please contact a real person?

The implication, when demanding human real time contact, is that the blog owner (or would be blog thief) can provide secret details - which when supplied, will convince a real Google security employee that the Blogger account / blog is the legal property of the complainant.

Secret details, which are jointly effective for Blogger / Google and the would be blog owner, are quite limited.

Account / blog recovery details have standards, to be useful.

Any account / blog recovery has to be based upon details which have three requirements.

1. The would be owner knows, and can use.
2. Blogger / Google can verify, within their own databases.
3. No third person can discover, using enough search time (Google or competitor) - or manufacture, using PhotoShop or a similar product.

Any details, which do not fulfill all 3 requirements, are either useless or unsafe. If unwisely accepted by Blogger / Google, they simply allow theft of someone else's properly secured Blogger account and blogs.

Verification can only use Blogger / Google maintained details.

Verification has to be based on Blogger / Google databases. Blogger cannot accept FaceBoook, Twitter, or WordPress personal pages or profiles, as proof of identity or ownership.

Blogger has a responsibility to active blog owners, to not permit theft.

Many complainants claim that Blogger is being unfair, in denying them access to their blogs. They overlook the fact that unwisely accepting publicly known or unverifiable details, as proof of blog ownership / identity, would be unfair to the millions of blog owners, who remember their login details - and are actively maintaining and publishing their blogs.

The purpose of account recovery is not to simply allow every blog owner access to their blogs, even if they casually neglected to remember required identification tokens (account name, email address, password, etc.). The purpose is to allow as many blog owners as possible access to their blogs - while preventing malicious blog theft by hackers able to misuse the provided recovery tools.

Active blog owners want their blogs to remain theirs.

People who carefully maintain access to their accounts and blogs do so, based on the presumption that Blogger / Google will not unwisely give someone else access. These people appreciate the Blogger promise that our blogs will remain ours, forever - as long as we exercise common sense and courtesy.

The many blog owners, who maintain both front door and back door access - and actively maintain and publish their blogs - do not really care about the few who need "their" long dormant blogs recovered - or who want to delete "their" blogs, so they can move their activity to FaceBook or WordPress. They appreciate that Blogger will not give up login details, without observing appropriate caution.

Please, Do Not Publicise Your Email Address

We've seen a few reports, recently, about stolen blogs, in Blogger Help Forum: Something Is Broken.

Why is my blog not on my dashboard - and why is somebody else publishing, and using my name?

There are so many reports from people who are not using Google "One Account" login properly, that the significance of this problem report was initially overlooked.

More than a few such reports started with the blog owner email address being openly disclosed - generally on the blog, or in comments. Too many blog owners want to be contacted - and they innocently provide their email addresses as a contact point.

We've known, for years, about disclosed email addresses, and brute force password guessing. That is not the only way your email address can be used, to gain access to your Blogger account, however.

Google recently had to deal with a very carefully executed hacking project, where Blogger and Google account owners received some well phrased advice, in their email.

Google treats policy violations and invalid activity very seriously in order to protect the users, publishers, and advertisers who make up our advertising ecosystem. While we usually notify publishers and take action for policy and invalid activity at the site level, there may be times when we will need to suspend or disable accounts due to policy violations or invalid activity.

Our hope is that you will be able to resolve your policy issues during the suspension period using This Link

I'm betting that the above message was written, very carefully, by hackers who studied the phrasing and wording of the many abuse / spam / TOS violation notices, sent out by Blogger Support constantly.

Many of the recipients of the email are the same crowd that I encountered, several years ago, when we saw similar numbers of reports about the same type of stolen blogs. The owners typically

• Post their email address, or provide it for contact, visibly.
• Participate in comment based networking, on their blog, and openly state their email address.
• Participate in comment based networking, on similar blogs, and openly state their email address.

Each of these activities can be used, by the bad guys, to build lists of email addresses, of people who can be easily persuaded by an email message, to resolve their policy issues using the link provided. And this led to a number of reports, in the forums, about stolen blogs - and mentioning email, offering to sell the stolen blogs back, to the rightful owners.

If you want contact from your readers, there are more safe ways to allow this.

• The Blogger "Contact Me" form.
• Blogger based comments, with email address concealed (and not stated openly).
• Google+ based comments / networking, with email address never involved (and not stated openly).
• Setup a second email account. Use one email account for contact - and a second for blog ownership.

All of the above contact options give you a possibility of hearing from and / or networking with, your readers - and none of these options require you to disclose your ownership email address.

Just don't disclose your email address, to the world at large. Your email address is one half of the security measure, as designed by Google - that prevents unknown individuals, from taking control of your Blogger account and your blogs.

Finally, if you are not yet using Google 2-Step Verification, this is the time. If you were one of the victims of the recent attack, you know the despair. If not, you truly don't want to be. In either case, you should really want to protect your account, and your blogs.

Your Right To Be Forgotten Does Not Supersede My Right To Retain Ownership Of My Blog

Thanks to a recent decision by the European Courts, many people are claiming the right to delete their blogs, and to have the search engines stop indexing their blogs.

Some people believe that this newly defined right entitles them to recover control of their blogs, published long ago, with access (account name and password) long forgotten. A few such people even have blogs owned by "legacy" Blogger accounts, never converted to Blogger / Google accounts.

Nobody has the right to unilaterally take control of a blog that may belong to somebody else. If you cannot prove yourself to be the owner of a given blog, Blogger Support should not provide to you control of that blog. Whether you want to delete a blog, or to change the content, you have to prove ownership of the blog.

So called "legacy" blogs are a concern, because even Blogger Support cannot authoritatively identify all "legacy" accounts. All that they can say is

If your blog was created before 2007, you may have a "legacy" Blogger account.

More properly, since some blogs were converted transparently (without realisation of the owner), they should say

If your blog was created before 2007, and never converted, you may have a "legacy" Blogger account.

The "legacy" account conversion took many years - and everybody was given many months of warning, to get their accounts converted. This was not an overnight process.

All that you can do is to try to convert your Blogger account, and see if you get control of your long forgotten blog. Even if converted, though, you have to be able to prove ownership of the account, once it's been converted - just as you have to prove ownership of any Blogger account.

Too many people try to steal ownership of someone else's blog, by claiming to own the blog - but conveniently forgot the account name or password.

Since there are more people working on their blogs (maybe not today, but sometime in the past), than are trying to recover control, people trying to recover control (or to steal someone else's blog), are going to get less support.

The term "actively working on their blog" implies no specific activity level. A blog, published once, 10 years ago, is just as valid as one published once daily for 10 years.

Blogger blog owners are entitled to the same courtesy and security - as long as each blog owner acts responsibly, and remembers the account name and password of an owning Blogger account. Similarly, blog owners are entitled to Blogger not providing clues, to blog thieves, that could assist in blog theft.

If Blogger / Google does not agree with your claim, and if you believe in the right to be forgotten, you hire a lawyer, and get a court order. Let the courts decide your special rights.

>> Top

Stolen Blogs Can Not, Generally, Be Returned

Whether you give up your blog willingly, have your blog stolen from you, or accidentally enable your blog to be stolen - once your blog is in someone else's control, Blogger cannot, legally, help you.

We see the naivete, periodically, in Blogger Help Forum: Something Is Broken.

I made my friend an administrator of my blog, and he changed me to an author. Can Blogger restore my ownership?

And the short answer, too frequently given, is denial.

No, Blogger cannot help you.

Blogs stolen, supposedly from their rightful owner, can generally not be returned by Blogger.

There are various ways to lose control of a blog.

• Some will, intentionally, transfer control - then change their mind.
• Others will naively make a friend a co-administrator - and have the friend take control of the blog.
• Still others may enable the blog to be stolen by a hacker.

In any case, once control passes to another person, it's unlikely that Blogger can, unilaterally, restore ownership.

Blog thieves are very persuasive - and masquerade as theft victims.

One problem here is that too many would be blog thieves start their tales with just these claims. Long ago, Blogger Support would, obediently, "restore" ownership, when requested - and we would later see the angry forum report.

How did this other person get control of my blog?

Blogger Support would research the second "theft" report - and realise, too late, that they had previously enabled the theft.

Blog owners enable some thefts, with security mistakes and requests.

Also, if you neglect to remember your account name or password, please don't just setup a new account, then suggest that Blogger transfer control of the blog, to the new account. This suggestion, also, has been used to make Blogger an unwitting accomplice in too many thefts.

Blog owners must assume some responsibility for problems.

The bottom line here is that you have to accept full responsibility, for retaining control of your Blogger account and blogs.

Even if your friends account is hacked, then used to attack yours, don't expect assistance from Blogger / Google. And please understand that blog security review won't happen, immediately.

"Nice Blog" Spam Is Not Random Garbage

Some time ago, I discovered an odd type of comment spam, which I termed "Nice Blog" spam.

Nice blog. I will keep visiting this blog very often.

This spam, from what I can tell, has been published by the millions, in various blog comments.

It's likely that this particular spam is being published as a very imaginative form of email address mining. The phrasing started out almost identical to the above example - but recently became rather imaginatively worded.

All that the spammer has to do is publish a "nice blog" spam comment, against a typical Blogger blog post, and select the option to "Send me replies".

Any comments published later against that post, and including the commenters actual email address, would be delivered directly to the spammers inbox. Knowing the email address - and the blog URL (how many comments do not include a link to a blog?) - the hacker would go straight to work.

Later, we would see forum reports.

I can't control my blog, any more - and somebody has filled it with spam!

This was a direct result of the former blog owner, having left a comment on somebody else's blog.

By eliminating our email addresses from our comments, Google is helping to protect our accounts and blogs, while letting us continue to comment on each others blogs - and to discourage one type of unnecessary spam from our blogs.

>> Top

Confusion About EMail Addresses Based On Google Apps Provided Email Domains

Since 2009, I've been explaining the intricate relationships between Blogger accounts, email addresses, and Google accounts.

One of the challenges of logging in to Blogger or Google involves account names and passwords, that may be shared with an email account that is the basis for the Blogger / Google account name.

Non GMail based Blogger / Google accounts initially share an account name / email address with the source non GMail email account. If you change a non GMail email address, the Blogger account name will not change. If you delete a non GMail account, the Blogger account is not deleted. Finally, even with shared account names, the passwords between the email account, and the Blogger / Google account, are not automatically shared.

With a GMail / Google based Blogger account, on the other hand, both the account name and password will be shared - since it's the same account. If you delete a GMail / Google Blogger account, the Blogger account - and all owned blogs - are also deleted.

Besides the account name / password confusion, use of the Google login wizard is complicated by use of Google Apps based email accounts.

Use of the new Google login wizard is a challenge because of the blind login process - and the lack of detailed diagnostics, when an incorrect account name or password is entered. The lack of detailed diagnostics helps prevent hacking of our Google accounts, when our email address and various personal details become known to the public. Any mistakes result in one monolithic error.

The email or password you entered is incorrect.

Google Apps based email accounts are a frequent concern, when frustrated custom domain owners need to access their Google Apps accounts, to either update domain registration payment details, or to access the registrars domain management dashboard.

Google Apps access, which uses the Google multi-account login wizard, is complicated by domain owners who do not realise (or remember) the non GMail based Google Apps account name - or the password.

Before Google Apps based email domains became an issue, it was possible to easily identify non GMail based Blogger / Google accounts, as opposed to GMail based accounts, based on one significant detail - the absence of "gmail.com" / "googlemail.com" in the account name.

Observing that a given Blogger account name did not include "gmail.com" / "googlemail.com", we could advise a Blogger account owner of the issues involving account name / password sharing, between the source email account, and the Blogger / Google account.

Thanks to the existence of Google Apps based email domains, it is now possible to have GMail / Google accounts which lack the "gmail.com" / "googlemail.com" in the account name - and we see the confusion.

• Some blog owners may delete an unused "non GMail" Google account, not realising that they are deleting the necessary Blogger / Google account that owns a given blog.
• Other blog owners may be unable to use the Google login wizard effectively, since they don't understand that a non "GMail.com" account may be a Google account.
• And, in truly unfortunate scenarios, we have blog owners who lose control of their blogs when their employer, Internet Service Provider, or school converts their domain to use Google apps management

Just as it's impossible to canonically identify "legacy" accounts, it's a challenge to adequately describe the issues specific to Google Apps based non "GMail.com" Blogger / Google accounts. Control and synchronisation issues, relevant to both the account names and passwords, will always cause confusion, to Blogger blog owners.

Articles about regaining account control - and proper use of the new Google One Login wizard - will be referenced frequently, in Blogger Help Forum: Something Is Broken.

>> Top

Referer Spam Cannot Be Blocked, Immediately

That is the unfortunate truth.

Every day, some new member of Blogger Help Forum: Something Is Broken asks, innocently

What is all this traffic from dodgy websites?

and after we explain what the dodgy traffic is, and why it does not reflect real traffic, the next question is

So why doesn't Google block it? Why should I have it polluting my Stats displays, and be unable to find actual traffic in my counts?

and the unfortunate truth is simply that Google cannot block it, because it's not significantly different from normal traffic - and the insignificant difference is not easily detected.

Referer spam cannot be identified, because it is identical in structure to legitimate Stats pageviews - and because its content changes, constantly.

What does a normal blog page "pageview request" look like?

When you click on a link from, say, a post in Blogger Help Forum: Something Is Broken, to this article, your computer sends a single message to the Blogger server, containing three essential details.

1. The IP address of your computer.
2. The URL of a forum discussion, which contains a link to this article.
3. The URL of this article.

From the message, the Blogger server creates a server activity record.

1. An IP address.
2. The URL of the page containing a link to the webpage requested.
3. The URL of the webpage requested.

That server activity record, in the Stats display for the blog, is known as a "pageview".

Finally, the Blogger server starts sending web page content back to your computer, so your computer can display this article to you. As the webpage content is sent back to your computer, your computer receives, and displays, the received content - and asks for more content.

What does a referer spam "pageview request" look like?

Simple enough? So, what is referer spam? Simply, a single message from a spammer computer, to the Blogger computer, containing three essential details.

1. An IP address - possibly, but not predictably, of their computer.
2. The URL of the website being pimped (the spammed website).
3. The URL of the blog being spammed (your blog).

From the message, the Blogger server creates a server activity record.

1. An IP address.
2. The URL of the page (supposedly) containing a link to the webpage requested.
3. The URL of the webpage (supposedly) requested.

That server activity record, in the Stats display for the blog, is also known as a "pageview".

Finally, the Blogger server starts sending web page content back to the IP address provided. If the IP address does refer to the spammers computer, what is received is simply ignored. The spammer computer moves on, and sends another fake pageview message to another server - maybe referencing this blog.

The "pageview request" is generated, before referer spam discontinues.

The problem is simply that no web server can detect a message from a client computer, that results in a response that is just ignored. Web traffic is lossy, and clients drop offline constantly. Even if the response could be detected as ignored, the ignored request might still reflect legitimate activity, initiated by a client that immediately went offline.

There is simply no way for Google to block the spam - because the spam is simply one message that results in a response, by the Blogger server, that is subsequently ignored by the client computer.

That's it.

So why can't Google block the numbers generated by referer spam, as the referer spam hits the servers? Simply because the numbers may not really represent actual spam. They can, just as easily, reflect intense, legitimate activity - or possibly a devious attack against a legitimate website.

Google can only detect referer spam in context, against multiple blogs.

Specific pageview counts and details are observed in context - are blocked only after the same activity is observed against multiple blogs, over long periods of time (similar, in concept, to stateful network traffic analysis) - and the numbers are removed, retroactively.

All of this is a simple unavoidable side effect, of blog owners needing site activity figures that are not affected by script filtering by the blog readers, complicated by fraudulent activity by hackers and spammers.

Referer spam is not unique to Blogger - it is simply tuned to abuse Stats logs.

Please note that referer spam did not start with Blogger - it's an Internet wide problem. Even though it appears mindless and random, some of it is craftily designed and executed.

For a comprehensive look at how referer spam works, outside Blogger, see Wikipedia: Referer spam.

The problem here is threefold.

1. Too many blog owners obsess over raw pageview counts.
2. Too many blog owners do not understand the origins of referer spam.
3. Too many blog owners are not interested in understanding the real problem.

That's it!

Recovering Your Account Information - Improved

Blogger has long promised us that our blogs will be ours, forever, and that we are free to publish our blogs in privacy, if we so desire. Based on those promises, not all Blogger blog owners have made the right decisions, in retaining access to their Blogger / Google accounts.

Many problem reports. from frustrated owners, are seen, daily, in Blogger Help Forum: Something Is Broken.

My email address changed some time ago, and now, I can't login to Blogger and update my blog!

Last year, Blogger made several changes to their account recovery policies and procedures, which made this subject, for many blog owners, a critical and painful issue. Now, Google is making an organised effort to reduce the pain, by improving their account recovery tool.

There are two tools which you may wish to try, when you cannot login directly, to your Blogger account.

• Blogger: Forgot your username or password?
• Google: Having trouble signing in?

Google re designed account recovery, in 2012.

Recognising the frustration caused by some recent changes to the Blogger / Google login, and to various account recovery procedures, Google recently improved the design of their account recovery tool. Formerly labeled

• Account Recovery: Forgot your password?

We now have

• Google: Having trouble signing in?

The newly designed wizard covers both Google account un deletion, and account recovery, transparently. It won't provide recovery of all Google services lost when the account was deleted, however.

The wizard has three initial selections.

• I forgot my password
• I forgot my username
• I'm having other problems signing in

I forgot my password

Immediately when selecting "I forgot my password", you'll be asked to provide the username of your Google account, labeled "Email address". As noted, this may be either a GMail address - or any non GMail email address.

To reset your password, enter the username you use to sign in to Google. This can be your Gmail address, or it may be another email address you associated with your account.

Having hit "Continue", expect to see a CAPTCHA. Successfully solving the CAPTCHA, you'll be presented with three options. Each of these options requires proper advance registration, by the blog owner.

Choose how to get back into your account.

• Get a verification code on my phone.
• Answer my security question
• Get a password reset link at my recovery email

I forgot my username

Immediately when selecting "I forgot my username", you'll need to provide the account recovery email.

Please enter the recovery email address you provided when creating your account.

Having entered the right email address, you'll next (surprise!) get to solve a CAPTCHA, and then receive the welcome news.

An email has been sent to xxxxxxx@yyyyy.zzz containing all Gmail usernames associated with that address.

Please make sure xxxxxxx@yyy.zzz is your recovery email address. If it is not, you will not receive an email containing your username.

Here, once again, we see the advantage of not remaining completely anonymous.

I'm having other problems signing in
Immediately when selecting "I'm having other problems signing in", you'll be asked for your Email address.

Enter the username you use to sign in to Google. This can be your Gmail address, or it may be another email address you associated with your account.

Having provided an email address (big surprise!!), you'll be asked to solve a CAPTCHA. Finally, you'll be provided the Google Accounts: Problems signing in to your account article, with additional selections.

Please select your issue:

• I forgot my password
• I think someone else is using my account
• I forgot my username
• I know my username and password, but I can't sign in
• I can't reset my password via SMS
• I use a Google Apps account
• I'm having trouble with 2-step verification

Here we see a wide assortment of options, all carefully provided to allow genuine Blogger blog owners to recover access to their Blogger / Google accounts, while preventing malicious hijacking. This should complement the separate Blogger blog access recovery wizard. You'd be wise to try at least some of these options, before asking for assistance, in a public forum.

The automated tools are necessary, to protect our accounts and blogs from people seeking to misuse the recovery process, and steal control of our accounts and our blogs.

Recovery works best with "lost access" accounts - "stolen" accounts will differ.

Now, you'll want to note that these wizards help you recover control of a Blogger / Google account that you simply have lost access. If your GMail / Google account has been successfully hijacked, you're going to need different corrective measures, for recovery and future protection.

Please note that both tools provided by Blogger / Google will work more reliably, with a blog that was not transferred improperly, from one Blogger account to another. And plan the recovery process, don't be caught unaware of the new recovery verification procedures.

Account Recovery Options, And Prevention Of Blogger Account / Blog Hijacks

Ever since Blogger started using Google accounts to authenticate Blogger account access, blog owners have had trouble maintaining access to their accounts and their blogs.

Not all Blogger blog owners understand - and less accept - the measures that Blogger has taken, to prevent malicious activity, by unknown persons who would use Internet obscurity to hijack their accounts, and their blogs.

Every day, we see numerous complaints in Blogger Help Forum: How Do I?, about inability to recover account access. And, we see occasional (not occasional enough) reports about blogs now owned by people who are not personally known by the rightful blog owner.

Blogger is continually improving their account recovery, authentication, and account hijack prevention policies. Unfortunately, as they improve in one area, they make things more difficult in another.

Until late 2010, Blogger / Google offered several options, for recovering account / blog access.

• An automated wizard, where you could provide the URL of your blog, and have account recovery instructions sent to the email address registered with the Blogger account(s) that administered the blog, accompanied by the welcomed advice

  We've sent password reset instructions to your email account xxxxxxx@yyyyy.zzz.

• An option, should the latter email account be unusable (the owner graduated from school, changed ISPs, changed jobs), to walk into many regional Google offices, present proof of identity, and regain access to some Blogger accounts.
• In some limited cases, to transmit a facsimile of specific proof of identity documents to a Google office, have identity verified remotely, and regain access to some Blogger accounts.

In early 2011, we noted a significant number of cases where people were reporting logging in to Blogger, and finding various personal blogs missing from the dashboard blog lists. Checking the blogs themselves, they were found to be still online - but now owned by other persons. In an alarming number of cases, the persons then owning the mysterious blogs appeared to be part of a malicious and well planned attack, against Blogger accounts and blogs.

In mid 2011, Blogger changed the automated account recovery wizard, to not display the email address being used for the password recovery. Now, we see less detail.

We've sent login instructions to your GMail account.

or even

We've sent login instructions to your account at y****.com.

To recover account access, the blog owner is now required to remember the email address - or minimally, to have access to all owned email accounts, and check each account, one by one, until login instructions are found.

To reduce the need for local and remote identity verification, Google enhanced the account recovery wizard, where the blog owner can provide an email address (whether or not usable for incoming email), provide secondary details to prove identity, and regain access. They also added Two Step Verification, which lets you use a pre registered cell or home phone, as an additional / alternate identity token - both to prevent hijackings, and to recover account access.

Unfortunately, people who idly forget the password and the email address, or who forget (or never provide) secondary personal details when setting up their Google account, will always be a challenge. Another challenge is provided by people who value anonymity, and setup multiple email accounts to obscure their real life identity from their Blogger blog ownership.

In specific cases, Blogger is known to provide mysterious "hints" to people who have gratuitously used multiple email accounts - and who cannot now remember all accounts used.

Your email address is a***0@yahoo.com.

However, the limited effectiveness of hints should always be noted. The Blogger Help Forum: [FAQ] Regarding account-related issues won't be going away, for lack of traffic, any time soon.

>> Top

A Hint Will Not Always Recover Your Access To Your Blogger Account

Some Blogger blog owners, trying to regain access to their blogs after a long absence, attribute their problem to over indulgent security measures.

I have too many email accounts, and no way can I remember all of them!

and maybe even

I have too many GMail accounts, and no way can I remember all of them!

Our suggestion will be, that they should carefully check all email (GMail) accounts. Their next request seems like a final solution.

Can Blogger just give me a hint, so I can remember which account I need to check?

Here they are asking for a last ditch effort, which is not guaranteed to bring success.

There are several reasons why requesting a hint - just a few characters of the email (GMail) account address - is not guaranteed to produce beneficial results.

• The hint request may be made by either a would be hijacker - or the possible later victim of a hijacker. The hint request invites focused brute force password guessing, which involves
  • Increased load on Google network resources.
  • Later problem reports about another stolen Blogger account / blog.
• A hint will not be given immediately. Blogger Support has several long queues of essential tasks. Helping somebody regain access to their Blogger account, after the would be owner has rejected the offered several automated tools, is not going to be at the top of anybody's task queue.
• A hint may not provide the right clue. Blogger Support will provide a limited number of characters in any hint - and cannot guarantee that the characters provided will be meaningful to the would be blog owner (or possibly, would be blog hijacker).
• Only one hint can be provided. Blogger Support won't provide an online game of "Hangman", by providing a new hint, until you guess your account name. One hint, only!

With all of these details in mind, and if at all possible, please do everybody a favour and make some effort to remember your account name and password. Don't count on Blogger to tell you your account name. Try the improved Google account recovery wizard, and check every email account which you may have possibly used, before asking for special attention.

>> Top

Blog Owners Report Disabled Blogger Accounts

This week, we're seeing a few reports, in Blogger Help Forum: Something Is Broken, of disabled Blogger and GMail accounts, again with ominous warnings of "suspicious activity" or "unusual activity" on your account.

Besides a disabled Blogger account, loss of AdSense, Blogger, Picasa, and other services is reported. This is similar to an earlier experience from May 2011.

In many cases, people with disabled accounts should be automatically redirected to Google Accounts Help: Account has been disabled.

Start with the generic "disabled account" instructions.

You can start there, where you are advised, generically, why accounts are being disabled.

If your account was not righteously disabled, you'll find the appropriate instruction in the last paragraph.

Please start by reviewing the relevant Terms of Service. Then, if you think your account should not have been disabled, please contact us.

Clicking on "contact us", you see Google Accounts Help: My account is disabled. Here, you are advised

Please summarize what happened when your account became disabled so we can investigate. We'll follow up with you only if we require more information or we have additional information to share.

Make sure that you can be contacted - anonymity is not possible, now.

Be sure to provide an active email address, for contact. When you fill out the form, this is not the time for insisting on anonymity. Selecting "No", for

Do you currently have access to the email address that you use to sign in to your account?

you are asked for

An email address we can use to contact you

If you truly want your account reactivated, provide an email account which you use, or check, frequently.

You'll have to wait, patiently, for account and blog review.

Having filled out the form, and hit "Submit", you wait, as patiently as possible. The number of similar reports, combined with the time of year (such as the first week following end of year holidays, when many people receive new computers), may cause the queue, from this form, to be processed relatively slowly.

Note that fuzzy spam classification may result in various Google accounts and assets being taken off-line and even deleted - and the accounts and assets may not all be restored immediately - or even simultaneously.

Specifically, we have noted latency on restoration of Blogger blogs, after the owning Blogger accounts are brought back on-line. If your Blogger account is a victim of "suspicious / unusual activity", allow for your blogs to be off-line 24 to 48 hours after the account has been restored. Blogger Engineers are aware that this is a problem.

---

Blog Owners Report Disabled Blogger / GMail / Google Accounts - January 2012

Why Can't Blogger Just Tell Me The Email Address?

We see the pain, in Blogger Help Forum: Something Is Broken, of blog owners who do not understand the need for keeping the name of their Blogger account a secret.

I forgot the email address that I was using. Why can't Blogger just tell me the address??

and some ask

How did this unknown person "xxxxx xxxxx" get control of my blog?

Years ago, the local police would have to convince home owners

Please, stop leaving a spare key under a rock, near the door!

Both many blog owners (today) - like some home owners (years ago) - had the same basic problem - naivete.

Like the home owners of years ago, who kept a spare key under a rock near the front door, for emergencies, blog owners will use tricks to remember their password.

Don't - please don't - use a guessable password!

One favourite technique, for remembering the password, is so obvious.

Pick a password based upon something that you can remember.

For a blog owner who is married, the answer is obvious.

What is my spouse's name?

and there's your password. If you forget that, you have worse problems, that cannot be addressed here.

If the name of one's spouse was a secret, using the name would not be a problem. But knowing that many blogs either contain the name (and picture, maybe) of the whole family - or lead to a Profile page or website (FaceBook, Instagram, Twitter, ...) with similarly useful information - how secret is the password going to be?

Hackers love blogs with guessable passwords.

Knowing both the Blogger account name (email address) that owns any blog of interest, and the URL of the blog, any hacker has a simple enough task.

1. Scrape blog content, into a text analyzer.
2. Extract a few hundred details (spouse's name, and others) from the blog content, as analysed.
3. Run the known details through a password generation program.
4. Now, the hacker has a database, containing "10,000 good possible passwords", specifically relevant to this blog.
5. Go to "www.blogger.com", plug in the account name, and try out the 10,000 passwords, one by one.
6. That's a simple brute force password attack.
7. Sit back, and watch any botnet, controlled by the hacker, go to work.
8. Given enough time, the hacker very likely gets access to the Blogger account, and to the blogs owned by the account.

Steps 1 - 8, for any experienced hacker, will be summed into one step.

Plug in the URL of the blog.

Everything needed is just more coding - and a nice robust botnet or two.

The hacker, of course, will be targeting thousands of different blogs, simultaneously. So what if he (she) fails to find what details she (he) needs, to steal your blog? He'll (she'll) gladly settle for another - while the botnet works on yours.

Besides using a "strong" password (which carries it's own risks such as forgetting the password - and now we're here, again), the best way to prevent a brute force attack is by preventing step 5.

Keep the account name / email address a secret.

Additionally, if you have a blog and a business - or otherwise exchange email with strangers, separate your Blogger / Google account and your email account. Use two separate email addresses, for Blogger and email.

Learn to appreciate efforts made, by Google, keeping your account and blogs safe.

If you need to recover access to your Blogger account, don't expect to use the Blogger "Forgot?" wizard, plug in your blog URL, and get a reply

Email was sent to your address xxxxxxx@yyyyy.zzz

And, if you post in the forum.

Please email me advice, to "xxxxxxx@yyyyy.zzz"!

expect to get a stern warning

Please, do not post Blogger account names, or email addresses, in the forum.

People objecting to the recent Blogger policy of masking email addresses, in Blogger commenting and similar services, as "no-reply @ blogger . com", may also need to consider this very real issue. Possibly, even use Google+, instead of Blogger commenting, for networking with ones peers.

Google tries to identify brute force attacks, and takes action when possible.

And, if your Blogger / GMail / Google account is disabled - and you get a mysterious notice about

Suspicious / Unusual activity on your account

this could well be the other side of a brute force attack against your account, intercepted by Google.

Don't be offended by the various precautions.

• The unpopular "24 to 48 hour" waiting period, which you endure after getting the account enabled.
• The painful diagnosis of "hacking detected" against your account (aka "suspicious" / "unusual" activity).
• The annoying inability to access your Blogger account, when traveling.

If you find the precautions and problems to be unacceptable, consider using Google 2-step verification, to protect your account against brute force hacking.

This is not fiction here - it's all very real.

None of this is fiction or paranoia - it's based on some very real, recent events, and even involves a recent National Scandal - and leads to some very real conundrums.

Similarly, we have a very distasteful answer, to a seemingly worthy need. And another apparently "ceremonial" but necessary answer, to somebody in need of understanding and support, that can't be provided.

You have to make the effort, to maintain and protect your blog.

You will get no sympathy, when you complain how unsupportive Blogger is.

You have to make some effort - and remember some basic information - if you are going to maintain a Blogger blog. And, encourage your friends to keep their accounts and blogs safe.

What Is "403 Forbidden"?

In terms of Blogger problems, which occur seemingly randomly and have no obvious user solution, I can't think of too many that bring more dread into peoples hearts than

403 Forbidden

That message is actually where I started this blog - many, many years ago. It's come up, in discussion, several times.

The message "403 Forbidden" is literally a response by a computer somewhere, saying that you are not permitted to access this computer. For Blogger / Google customers, it generally has a slightly different origin.

The "403 Forbidden" message, for Blogger blog owners, is frequently the result of a networking technique, used by Google and owners of other large networks, for blocking suspicious network traffic.

"403 Forbidden" refers to suspicious network traffic, maybe from a bot cluster.

It generally means that some group of computers, in your ISPs address space, are controlled by somebody besides their legal owners - and are generating excessive network traffic which the Google networks are detecting as suspicious. The "suspicious activity" may involve brute force password guessing, or botnet driven new blog setup activity, or maybe excessive relaying of referer spam.

Some other Blogger account owner(s), somewhere else in the world, may be seeing a "Disabled account" notice, referring to "suspicious activity on your account", or maybe odd links to pornographic websites, from the Stats logs.

Google initially blocks the general address space, to examine the problem.

In order to continue service to the world in general, Google will block the problem computers, from access to their networks. If the Internet address used by your computer is similar to the addresses used by the problem computers, Google will block your computer, along with the other computers (your neighbours computers).

You may have to wait this problem out, as Google researches it.

If this happens to you, there's probably nothing that you can do but wait this out. One or more things will happen, eventually.

1. Other Google users will report the symptom - or validate their identity - and Google will research the problem.
2. Google will research the problem, reduce the range of addresses blocked, and remove the block on your specific address space.
3. The computers involved will go offline, or otherwise cease their attacks, and Google will remove the network block.

If you know how to, and if your Internet service allows you to do this, you may be able to change your Internet address. This solution won't be universally effective, though.

• Your Internet service ("Fixed IP") may not allow this.
• You may not know how to do this.
• Your Internet service may detect this change, by you, as suspicious activity.
• Your new address may also be blocked by Google, because of activity by another set of problem computers.
• Your new address may be blocked by another Internet service, and you'll have to start over with them.

So right now, I'll not go into the details of changing your address - though you may try doing this, if you wish. It's your computer, after all.

Use A Proxy Server, When Following Stats Links

We've been observing the ongoing problem with referer spam since the beginning of the year - yet we see that some blog owners still haven't heard of the problem. Some folks who are advised later, to be more cautious

Don't click on the links!

come back with anxious queries

I already clicked on the link! What will happen now? Have I been hacked?

Here, there's no authoritative answer.

When you click on a Stats traffic source link, and get an eyeful of porn or spam, you're not going to be happy - but hopefully, if your computer is well protected, chances are probably good that you're OK. On the other hand, if this makes you anxious, it would not be a bad idea to get the computer checked out.

In the future, if you must check out your Stats traffic sources, use a proxy server. Again, don't click on the links - copy the URLs, and paste them into the proxy server address window.

If you surf to a referring website and like what you see, then go back, click on the link, and bookmark the URL. Just do this after you screen the traffic source.

If, one day, Blogger uses SafeSearch to screen the URLs, we'll be safe again. And shortly afterwards, referer spam will dry up as the people who pay for spam based advertising stop paying.

>> Top