Does Google SafeBrowsing Prove “Bad IP Neighborhood” Theory

SMS Text

We all know about and probably use Google Safe Browsing tool – the best idea is to use it to identify one of the reasons of a possible Google penalty. For that use the following URL (add your domain at the end):

The above query will show you if Google has ever detected Malware on your site and also will invite you to check your site network(s) the domain is hosted on:

Google safebrowsing

Following the link you will be able to see your network information as well as some of your bad neighbors:

Google safebrowsing - network report

An interesting issue is being discussed over at WebmasterWorld forums: is the fact that Google analyses domains on the same network means it treats suspiciously your site if it has bad IP neighbors?

According to the official Google tech report [pdf] overviewing the detection system and data analysis methodology:

Interestingly, Anderson et al. [3] observed comparable IP space concentrations for the scam hosting infrastructure.

That said, Google appears to identify the interesting patterns:

  • Sites distributing Malware are usually hosted on different IP addresses, whereas:
  • Sites infected with Malware are often hosted within one IP range.

To conclude, citing from the thread above:

If you’re hosted at the same IP address as a troublesome spammer, then I have no doubt this could cause you problems. Otherwise, I think any impact is negligible. If you look at sites on the same IP, the same ranges or the same network then it’s easy to come across some crazy connections between sites. But I doubt it has any effect on a typical evaluation of a page for relevancy.

What do you think?

Ann Smarty

Ann Smarty

Brand amd Community Manager at Internet Marketing Ninjas
Ann Smarty is the blogger and community manager at Internet Marketing Ninjas. Ann's expertise in blogging and tools serve as a base for her writing,... Read Full Bio
Ann Smarty
Subscribe to SEJ!
Get our weekly newsletter from SEJ's Founder Loren Baker about the latest news in the industry!
  • Dave

    Well Ann, I have to think there is something to be looking at here. What has me mostly interested in the recent patent granted to Google on host level spam detection;

    There is every chance that being on a server with a bunch of spammers could actually be problematic…

    Alex (from Majestic) came by for a guest post on ways to look into it here;

    …. sooooo… it is def an area we should at least consider from time to time.

  • Thomas J. Raef

    We’ve run a number of tests and analysis on this issue.

    We found a website hosting malscripts (not malware, just infectious javascript leading visitors to a site hosting malware), we looked at the AS number and found other websites on that same IP address.

    Next, we used the Google Safebrowsing API to lookup the other websites on that IP address, then checked to see if the type of infection on any of those websites matched what we found on the original site.

    Our intention was to see if we could determine if it was a server breach or was it individual sites being compromised.

    The determining criteria we used was if the infection was martuz/gumblar or similar across all the sites, or, if the infectious code found on each was similar in obfuscation technique.

    Rarely, did we find any single IP address that had the same type or same method of malscript. (less than 1% of 1,000 IP addresses checked)

    This leads us to believe that the “blame game” that goes on for hosting providers, is pointless. Better than 99% of the time, it’s the fault of the website owner and not the hosting provider.

    At least that’s what we came away with.

  • SeoAntares

    Thanks! Interesting topic of SEO, I also asked “How GOOGLE evaluates multiple sites on one IP”

  • Mick Lehr

    If concerned; a dedicated server would be the best way to go.