{"id":9020,"date":"2019-03-01T00:05:19","date_gmt":"2019-03-01T00:05:19","guid":{"rendered":"https:\/\/www.gmass.co\/blog\/?p=4020"},"modified":"2020-10-07T05:52:07","modified_gmt":"2020-10-07T05:52:07","slug":"google-safe-browsing","status":"publish","type":"post","link":"https:\/\/www.gmass.co\/blog\/google-safe-browsing\/","title":{"rendered":"Google&#8217;s Safe Browsing program made my week hell"},"content":{"rendered":"<p>Google&#8217;s <a href=\"https:\/\/safebrowsing.google.com\/\">Safe Browsing<\/a> program protects a lot of people from <strong>phishing<\/strong>, <strong>malware<\/strong>, and other harmful sites. In fact, it&#8217;s so pervasive that it&#8217;s not just used by Chrome. Google has managed to get competing browsers,\u00a0<strong>Safari and<\/strong>\u00a0<strong>Firefox,<\/strong>\u00a0to use it as well. The list of websites blacklisted though is all maintained by Google, giving Google\u00a0a\u00a0disproportionate amount of power over what sites are seen versus blocked.<\/p>\n<p>I&#8217;ll explain what happened during our harrowing week in a moment; but first, let me share an <strong>update about Google&#8217;s Safe Browsing API<\/strong>:<\/p>\n<ul>\n<li>Effective September 11, 2019, the <strong><a href=\"https:\/\/developers.google.com\/safe-browsing\">Safe Browsing API<\/a><\/strong> is limited to non-commercial use only. It is a free service.<\/li>\n<li>If you&#8217;re a <strong>non-commercial user<\/strong>, you can continue to use the Safe Browsing API, and you don&#8217;t need to take any action. Also, a<span data-preserver-spaces=\"true\">cademic researchers and NGOs will continue to be eligible to use the Safe Browsing API at no cost.\u00a0<\/span><\/li>\n<li><strong>Commercial users<\/strong>, like GMass, are required to switch to the <strong><a href=\"https:\/\/cloud.google.com\/web-risk\/\">Web Risk API<\/a><\/strong> by November 11, 2019. This version is a paid service, and if you&#8217;re a commercial user, as we are, then you&#8217;ll need to switch. Also, you&#8217;ll need to apply and be approved to use the API, so don&#8217;t wait.<\/li>\n<li>Both APIs are directed at protecting users from malware and phishing, but the new Web Risk API is designed specifically for larger users.<\/li>\n<\/ul>\n<p>And now, back to our story &#8230;<\/p>\n<h3>What happened?<\/h3>\n<p>At the beginning of last week, my team\u00a0suddenly had a deluge of complaints from <strong>users reporting that their links had stopped working<\/strong>, their <strong>sending limits had been reduced<\/strong>, and they&#8217;d <strong>received phishing notifications from Google<\/strong>. Ouch! Upon investigating, we found that the tracking domains they use in their email campaigns\u00a0had ended up on the Google&#8217;s Safe Browsing blacklist, and when people clicked links in their campaigns, they ended up on this scary bright red Google warning page.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4027\" src=\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2019\/02\/Gmail-Dangerous-Warning-Link-Wordzen-Com-web.png\" alt=\"\" width=\"1685\" height=\"613\" \/>There&#8217;s the rub. <em>Not only does Google list actual phishing sites, but any sites that re-direct to them as well.<\/em> That makes it so that any providing click-tracking services, including <strong>URL shorteners<\/strong> and <strong>email marketing service providers<\/strong>, have to be extra cautious.<\/p>\n<p>In slogging through our logs we found that a Netflix phisher had managed to send 200 emails through GMass on Sunday, February 17. Here&#8217;s the email he sent. Notice that the URL behind the link is highlighted at the bottom. In this case, the URL https:\/\/www.gregsimages.com\/cgi-bin led to the red screen of death, as did our click-tracked links that redirected to this URL.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4026\" src=\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2019\/02\/Safe-Browsing-Netflix-Email-web.png\" alt=\"\" width=\"1333\" height=\"574\" \/><\/p>\n<h3>The effect of being listed goes beyond just the web<\/h3>\n<p>What happens to your email campaigns when you send a URL that&#8217;s on this list? Gmail makes you\u00a0feel like the devil reincarnate.<\/p>\n<ol>\n<li>Your Gmail account\u00a0becomes <strong>severely limited<\/strong> and\u00a0<strong>unable able to send any substantial volume<\/strong> of emails.<\/li>\n<li>If you do manage to\u00a0send an email with a blacklisted link,\u00a0and that link is clicked, you&#8217;ll <strong>scare the\u00a0bejesus out of them<\/strong> with\u00a0the red screen of death.<\/li>\n<li>Your <strong>past campaigns are affected<\/strong> too, if someone pulls up one of those old emails and clicks a link.<\/li>\n<li>If people <strong>reply<\/strong> to you, the reply will still have the original email at the bottom, with the link that you sent, and Google <strong>will flag the <em>reply to you<\/em> as a potential scam<\/strong> too.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4028\" src=\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2019\/02\/Gmail-Dangerous-Warning-web.png\" alt=\"\" width=\"2509\" height=\"1618\" \/><\/li>\n<\/ol>\n<p>Obviously not a good look for an email marketer.<\/p>\n<h3>What was actually affected?<\/h3>\n<p>In our case, when we got the notice that <strong>link.wordzen.com was listed<\/strong>, I wanted to <strong>isolate which link.wordzen.com URLs were affected<\/strong>.<\/p>\n<p>Using the public <a href=\"https:\/\/transparencyreport.google.com\/safe-browsing\/search?hl=en\">Safe Browsing lookup tool<\/a>, which is different from the private tool everyone has in their <strong>Search Console<\/strong>, I found that plugging in just link.wordzen.com gave this result, indicating that some URLs were affected and others weren&#8217;t:<\/p>\n<figure id=\"attachment_4078\" aria-describedby=\"caption-attachment-4078\" style=\"width: 3168px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-4078 size-full\" src=\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2019\/03\/Safe-Browsing-Lookup-Some-Unsafe-web.png\" alt=\"\" width=\"3168\" height=\"1874\" \/><figcaption id=\"caption-attachment-4078\" class=\"wp-caption-text\">Just &#8220;link.wordzen.com&#8221; indicates that SOME pages are unsafe.<\/figcaption><\/figure>\n<p>But if I plugged in our original click tracking structure, link.wordzen.com\/x\/c, then the issue was clear that all \/x\/c links were blacklisted<\/p>\n<figure id=\"attachment_4079\" aria-describedby=\"caption-attachment-4079\" style=\"width: 3180px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-4079 size-full\" src=\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2019\/03\/Safe-Browsing-Lookup-Unsafe-web.png\" alt=\"\" width=\"3180\" height=\"1798\" \/><figcaption id=\"caption-attachment-4079\" class=\"wp-caption-text\">Using our old click-tracking link structure shows that all URL redirects using link.wordzen.com are unsafe.<\/figcaption><\/figure>\n<p>Curious, though, I wondered what would happen if I changed the URL slightly, so I tried link.wordzen.com\/x\/d and found that those URLs came back clean<\/p>\n<figure id=\"attachment_4082\" aria-describedby=\"caption-attachment-4082\" style=\"width: 3180px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-4082 size-full\" src=\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2019\/03\/Link-Wordzen-Com-Safe-web-1.png\" alt=\"\" width=\"3180\" height=\"1204\" \/><figcaption id=\"caption-attachment-4082\" class=\"wp-caption-text\">Slightly altering the link structure makes the link safe again.<\/figcaption><\/figure>\n<p>You&#8217;ll see below that this discovery led me to change the structure of a click-tracked link.<\/p>\n<h3>Some\u00a0nonsense associated with the Safe Browsing Program<\/h3>\n<h5><span style=\"color: #800080;\">1. Despite claims of transparency, it&#8217;s anything but.<\/span><\/h5>\n<p>As soon as your domain has been listed, you will probably want to know the URL that caused the issue. Unfortunately for you, <strong>Google won&#8217;t tell you<\/strong>. In the <strong>Search Console<\/strong> you might see this:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4045\" src=\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2019\/02\/Google-Search-Console-Blacklisted-web-1.png\" alt=\"\" width=\"1240\" height=\"942\" \/><\/p>\n<p>If you received an email notification about the blacklisting, that will have a portion of the URL.<\/p>\n<figure id=\"attachment_4039\" aria-describedby=\"caption-attachment-4039\" style=\"width: 1132px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-4039 size-full\" src=\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2019\/02\/Social-Engineering-Email-Notification-web-1.png\" alt=\"\" width=\"1132\" height=\"1241\" \/><figcaption id=\"caption-attachment-4039\" class=\"wp-caption-text\">The email notification you receive provides some clue as to the offending URL, while the notice in the Search Console gives you NO worthwhile info.<\/figcaption><\/figure>\n<p>For my purposes, this did not help at all, because every click-tracked link in the history of GMass starts with \/x\/c. The important stuff is all <em>after<\/em> that part, and that&#8217;s the part that Google eliminates from its reports. <strong>How this qualifies as transparency is beyond me.<\/strong><\/p>\n<p><em>So what do you do now?<\/em> You crawl through your logs and figure out what happened. In my case, I ran all sorts of analyses, starting with a time distribution analysis of all clicks in the last 72 hours, looking for anomalies. I also discovered my new best friend, a tool from Microsoft called <a href=\"https:\/\/gallery.technet.microsoft.com\/Log-Parser-Studio-cd458765\">Log Parser Studio<\/a>, that lets me run SQL queries against my IIS log files, <em>without importing the log files<\/em> into a database. Slick! That&#8217;s how I concluded that the aforementioned Netflix phisher was the culprit.<\/p>\n<h5><span style=\"color: #800080;\">2. The Safe Browsing API has been broken since day one.<\/span><\/h5>\n<p>I&#8217;m <a href=\"https:\/\/groups.google.com\/forum\/#!topic\/google-safe-browsing-api\/pdVIo3qXsGk\">not the only one<\/a>\u00a0who&#8217;s\u00a0frustrated over\u00a0the seemingly useless <a href=\"https:\/\/developers.google.com\/safe-browsing\/v4\/\">Safe Browsing API<\/a>.<\/p>\n<p>Here&#8217;s a screenshot showing the listing of link.wordzen.com.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4032\" src=\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2019\/02\/Google-Search-Console-Blacklisted-web.png\" alt=\"\" width=\"1240\" height=\"942\" \/><\/p>\n<p>Here&#8217;s a screenshot showing the API result:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4033\" src=\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2019\/02\/Safe-Browsing-API-Fail-web.png\" alt=\"\" width=\"2121\" height=\"969\" \/><\/p>\n<p>So with a useless API, how does one monitor whether new URLs have been listed or old URLs have been marked safe? I used Upwork to quickly a hire a team of <strong>Virtual Assistants in the Philippines<\/strong> to <strong>manually enter all 1,400<\/strong> of our customers&#8217; tracking domains into the web lookup tool and to do so <strong>every 12 hours until further notice<\/strong>.<\/p>\n<p>In case you&#8217;re a C# programmer and want to try this yourself, here&#8217;s the code:<\/p>\n<pre class=\"p1\"><span class=\"s2\">            string<\/span><span class=\"s1\"> apikey = <\/span>\"AIzaSyBnIDLCc*************z4twxdx28\"<span class=\"s1\">;<\/span>\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0   <\/span><span class=\"s2\">string<\/span> payload = <span class=\"s3\">@\"{<\/span>\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span>\"\"client\"\": {\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span>\"\"clientId\"\":<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 <\/span>\"\"gmass\"\",\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span>\"\"clientVersion\"\": \"\"1.0.0\"\"\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span>},\r\n\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span>\"\"threatInfo\"\": {\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span>\"\"threatTypes\"\":<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 <\/span>[\"\"MALWARE\"\", \"\"SOCIAL_ENGINEERING\"\", \"\"UNWANTED_SOFTWARE\"\", \"\"POTENTIALLY_HARMFUL_APPLICATION\"\"],\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span>\"\"platformTypes\"\":<span class=\"Apple-converted-space\">\u00a0 \u00a0 <\/span>[\"\"WINDOWS\"\"],\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span>\"\"threatEntryTypes\"\": [\"\"URL\"\"],\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span>\"\"threatEntries\"\": [\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span>{\"\"url\"\": \"\"http:\/\/link.wordzen.com\"\"}\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span>]\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span>}\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span>}\"<span class=\"s1\">;<\/span>\r\n\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span><span class=\"s2\">using<\/span> (<span class=\"s2\">var<\/span> client = <span class=\"s2\">new<\/span> <span class=\"s4\">HttpClient<\/span>())\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span>{\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span><span class=\"s2\">var<\/span> content = <span class=\"s2\">new<\/span> <span class=\"s4\">StringContent<\/span>(payload, <span class=\"s4\">Encoding<\/span>.Default, <span class=\"s5\">\"application\/json\"<\/span>);\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span><span class=\"s2\">var<\/span> response = client.PostAsync(<span class=\"s5\">$\"https:\/\/safebrowsing.googleapis.com\/v4\/threatMatches:find?key=<\/span>{apikey}<span class=\"s5\">\"<\/span>, content).Result;\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span><span class=\"s2\">string<\/span> resultContent = response.Content.ReadAsStringAsync().Result;\r\n<span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span>}<\/pre>\n<p>There is also a <a href=\"https:\/\/developers.google.com\/api-client-library\/dotnet\/apis\/safebrowsing\/v4\">.NET client library for the Safe Browsing API<\/a>, but I chose not to use it because I wanted to be\u00a0in control of the exact JSON payload request\u00a0so that I knew that I wasn&#8217;t making a mistake.<\/p>\n<h5><span style=\"color: #800080;\">3. Reviews take a long time to process.<\/span><\/h5>\n<p>Despite <a href=\"https:\/\/developers.google.com\/web\/fundamentals\/security\/hacked\/request_review\">Google&#8217;s claims<\/a><strong> that a phishing URL will be reviewed within 24 hours<\/strong> and a <strong>malware\u00a0URL\u00a0within 72 hours<\/strong>, I found it <strong>took more like 120 hours (5 days)<\/strong>. After a week of hell though, there&#8217;s no sweeter email one can receive than this, clearing your\u00a0domain off the dreaded blacklist:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-4034\" src=\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2019\/02\/Safe-Browsing-Review-Successful-web.png\" alt=\"\" width=\"943\" height=\"786\" \/><\/p>\n<p>You can submit each URL for review, and in our case, we did it for hundreds of our customers too.<\/p>\n<h3>How\u00a0I worked around the blacklisting of 300 domains<\/h3>\n<p>During the time our customers&#8217; domains were listed, we couldn&#8217;t just sit idle\u00a0waiting for Google, because customers needed to\u00a0send their email campaigns out. We took a number of counter-measures and you can take these too, should you find yourself in this situation.<\/p>\n<h5><span style=\"color: #800080;\">1. Removed\u00a0all affected customer tracking domains from their accounts<\/span><\/h5>\n<p>The first step we took was to remove all the affected tracking domains from users&#8217; accounts, causing them to fall back to our shared tracking domain, which for paying users, is a clean domain based on Amazon&#8217;s AWS domain. That eliminated the issue in future campaigns.<\/p>\n<h5><span style=\"color: #800080;\">2. Altered structure of click tracking link<\/span><\/h5>\n<p>I felt a little shady making this change system-wide, but it turned out it worked, and saved me from an ever-growing mob of angry users. The old structure of a click-tracked link looked like:<\/p>\n<pre>http:\/\/link.wordzen.com\/x\/c?c=2724793&amp;l=dedb940f-55dd-4c33-a3cc-f5d8028183ca&amp;r=ed06197e-cf9e-4fea-a371-d5f455968519<\/pre>\n<p>By\u00a0plugging various combinations of URL structures into the <a href=\"https:\/\/transparencyreport.google.com\/safe-browsing\/search?hl=en\">lookup tool<\/a>, we noticed that the link above was flagged as dangerous, but if we made a simple change, changing the \/c to \/d, then the URL came back as safe, so we changed the structure of links to use \/d instead of \/c, like this:<\/p>\n<pre>http:\/\/link.wordzen.com\/x\/d?c=2724793&amp;l=dedb940f-55dd-4c33-a3cc-f5d8028183ca&amp;r=ed06197e-cf9e-4fea-a371-d5f455968519<\/pre>\n<p>Of course for backward compatibility, we made sure that the \/c URLs still worked also.<\/p>\n<p>Making this change allowed users to keep using their custom tracking domain, even if their tracking domain was still listed in the Safe Browsing system as a potential phishing domain.<\/p>\n<h5><span style=\"color: #800080;\">3. Locked down how click-tracking works to prevent future issues<\/span><\/h5>\n<p>I should have implemented this from day one, but I could have never expected an evildoer to exploit this loophole. You may know that to set up a custom tracking domain, you create a sub-domain off your existing domain and set its CNAME to x.gmtrack.net. So in my case, link.wordzen.com has a CNAME to x.gmtrack.net and that&#8217;s what allows it to function as the tracking domain for my email campaigns. But let&#8217;s say that you set up link.yourdomain.com as your tracking domain. Before, you could substitute the domain portion of a URL with a different tracking domain, and the redirect would still work.<\/p>\n<p>For example, you could <strong>substitute<\/strong> the &#8220;link.wordzen.com&#8221; portion of:<\/p>\n<p>http:\/\/link.wordzen.com\/x\/d?c=2724793&#038;l=dedb940f-55dd-4c33-a3cc-f5d8028183ca&#038;r=ed06197e-cf9e-4fea-a371-d5f455968519<\/p>\n<p>with any other user&#8217;s tracking domain, and the redirect to the GMass website would still work. This is what a recipient of the Netflix phishing email did. He substituted as many of our customers&#8217; tracking domains as he could find into the URL that led to the phishing page, accessed those URLs, and then <a href=\"https:\/\/safebrowsing.google.com\/safebrowsing\/report_general\/\">submitted them to Google&#8217;s Safe Browsing database<\/a>.<\/p>\n<p>Now, however, after locking it down, using a tracking domain that wasn&#8217;t originally associated with the link won&#8217;t automatically redirect the recipient to the website. Instead, an interstitial page will load. Try it with this link where I&#8217;ve substituted the tracking domain with a different user&#8217;s:<\/p>\n<p><a href=\"http:\/\/track.texthub.com\/x\/d?c=2724793&amp;l=dedb940f-55dd-4c33-a3cc-f5d8028183ca&amp;r=ed06197e-cf9e-4fea-a371-d5f455968519\">http:\/\/track.texthub.com\/x\/d?c=2724793&amp;l=dedb940f-55dd-4c33-a3cc-f5d8028183ca&amp;r=ed06197e-cf9e-4fea-a371-d5f455968519<\/a><\/p>\n<h3>TL; DR<\/h3>\n<p>Been <strong>blacklisted<\/strong> by Google&#8217;s Safe Browsing program? Here are the things to know.<\/p>\n<ol>\n<li><strong>Don&#8217;t use the API to monitor<\/strong> listings. It doesn&#8217;t work.<\/li>\n<li>The <strong>information in the Search Console is mostly useless<\/strong>.\u00a0The better information is <strong>in the email notification<\/strong> about the listing.<\/li>\n<li>After fixing the issue, <strong>submit your site for review<\/strong>, but don&#8217;t expect an immediate resolution. <strong>It can take a week for delisting to occur.<\/strong><\/li>\n<li>While you&#8217;re waiting on #3, try to work around the issue, like we did by <strong>altering the structure of click-tracking links<\/strong>. Listings in the Safe Browsing database seem to be based on a regex match, not every single URL at your domain.<\/li>\n<li>If all else fails, use <a href=\"https:\/\/www.wired.com\/story\/google-safe-browsing-oral-history\/\">this Wired article to track down the team of Google engineers<\/a> that built the <strong>Safe Browsing<\/strong> product. There&#8217;s a list of names at the bottom. Use LinkedIn, Hunter.io, or any means necessary to\u00a0track someone down.<\/li>\n<\/ol>\n<h3>More exciting tales&#8230;<\/h3>\n<p>This isn&#8217;t my only encounter with the Google Safe Browsing program. In September 2020, I faced another harrowing issue when the program <a href=\"https:\/\/www.gmass.co\/blog\/zendesk-domain-blacklisted\/\">blacklisted the domain we use with Zendesk<\/a>. I also have an interesting story involving a <a href=\"https:\/\/www.gmass.co\/blog\/spamhaus-dbl-listing\/\">Spamhaus blacklisting<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Google&#8217;s Safe Browsing program protects a lot of people from phishing, malware, and other harmful sites. In fact, it&#8217;s so pervasive that it&#8217;s not just used by Chrome.\u2026<\/p>\n","protected":false},"author":2,"featured_media":9027,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[4253,4268,4259],"tags":[],"class_list":["post-9020","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-how-to-guides","category-interesting","category-tracking-domain"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\r\n<title>Google&#039;s Safe Browsing program made my week hell<\/title>\r\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\r\n<link rel=\"canonical\" href=\"https:\/\/www.gmass.co\/blog\/google-safe-browsing\/\" \/>\r\n<meta property=\"og:locale\" content=\"en_US\" \/>\r\n<meta property=\"og:type\" content=\"article\" \/>\r\n<meta property=\"og:title\" content=\"Google&#039;s Safe Browsing program made my week hell\" \/>\r\n<meta property=\"og:description\" content=\"Google&#8217;s Safe Browsing program protects a lot of people from phishing, malware, and other harmful sites. In fact, it&#8217;s so pervasive that it&#8217;s not just used by Chrome.\u2026\" \/>\r\n<meta property=\"og:url\" content=\"https:\/\/www.gmass.co\/blog\/google-safe-browsing\/\" \/>\r\n<meta property=\"og:site_name\" content=\"GMass Blog\" \/>\r\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/GmailMailMerge\/\" \/>\r\n<meta property=\"article:published_time\" content=\"2019-03-01T00:05:19+00:00\" \/>\r\n<meta property=\"article:modified_time\" content=\"2020-10-07T05:52:07+00:00\" \/>\r\n<meta property=\"og:image\" content=\"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2019\/02\/Gmail-Dangerous-Warning-Link-Wordzen-Com-web.png\" \/>\r\n\t<meta property=\"og:image:width\" content=\"1685\" \/>\r\n\t<meta property=\"og:image:height\" content=\"613\" \/>\r\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\r\n<meta name=\"author\" content=\"Ajay Goel\" \/>\r\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\r\n<meta name=\"twitter:creator\" content=\"@PartTimeSnob\" \/>\r\n<meta name=\"twitter:site\" content=\"@GMassForGmail\" \/>\r\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ajay Goel\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\r\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/google-safe-browsing\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/google-safe-browsing\\\/\"},\"author\":{\"name\":\"Ajay Goel\",\"@id\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/#\\\/schema\\\/person\\\/b5fa74f8765b860701158fd77162fff8\"},\"headline\":\"Google&#8217;s Safe Browsing program made my week hell\",\"datePublished\":\"2019-03-01T00:05:19+00:00\",\"dateModified\":\"2020-10-07T05:52:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/google-safe-browsing\\\/\"},\"wordCount\":2012,\"commentCount\":11,\"image\":{\"@id\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/google-safe-browsing\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/02\\\/Gmail-Dangerous-Warning-Link-Wordzen-Com-web.png\",\"articleSection\":[\"In Depth How-To Guides\",\"Interesting\",\"Tracking Domain\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.gmass.co\\\/blog\\\/google-safe-browsing\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/google-safe-browsing\\\/\",\"url\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/google-safe-browsing\\\/\",\"name\":\"Google's Safe Browsing program made my week hell\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/google-safe-browsing\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/google-safe-browsing\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/02\\\/Gmail-Dangerous-Warning-Link-Wordzen-Com-web.png\",\"datePublished\":\"2019-03-01T00:05:19+00:00\",\"dateModified\":\"2020-10-07T05:52:07+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/#\\\/schema\\\/person\\\/b5fa74f8765b860701158fd77162fff8\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/google-safe-browsing\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.gmass.co\\\/blog\\\/google-safe-browsing\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/google-safe-browsing\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/02\\\/Gmail-Dangerous-Warning-Link-Wordzen-Com-web.png\",\"contentUrl\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/02\\\/Gmail-Dangerous-Warning-Link-Wordzen-Com-web.png\",\"width\":1685,\"height\":613},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/google-safe-browsing\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Google&#8217;s Safe Browsing program made my week hell\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/\",\"name\":\"GMass Blog\",\"description\":\"Tips and tricks for sending mail merge and mass email campaigns directly from Gmail\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/#\\\/schema\\\/person\\\/b5fa74f8765b860701158fd77162fff8\",\"name\":\"Ajay Goel\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f3a70af05bbabe47925150d5a1320540e801b78055a74da20658fc97cd0706a2?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f3a70af05bbabe47925150d5a1320540e801b78055a74da20658fc97cd0706a2?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f3a70af05bbabe47925150d5a1320540e801b78055a74da20658fc97cd0706a2?s=96&d=mm&r=g\",\"caption\":\"Ajay Goel\"},\"description\":\"Ajay is the founder of GMass and has been developing email sending software for 20 years.\",\"sameAs\":[\"https:\\\/\\\/twitter.com\\\/PartTimeSnob\",\"https:\\\/\\\/x.com\\\/PartTimeSnob\"],\"url\":\"https:\\\/\\\/www.gmass.co\\\/blog\\\/author\\\/ajay-goel\\\/\"}]}<\/script>\r\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Google's Safe Browsing program made my week hell","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.gmass.co\/blog\/google-safe-browsing\/","og_locale":"en_US","og_type":"article","og_title":"Google's Safe Browsing program made my week hell","og_description":"Google&#8217;s Safe Browsing program protects a lot of people from phishing, malware, and other harmful sites. In fact, it&#8217;s so pervasive that it&#8217;s not just used by Chrome.\u2026","og_url":"https:\/\/www.gmass.co\/blog\/google-safe-browsing\/","og_site_name":"GMass Blog","article_publisher":"https:\/\/www.facebook.com\/GmailMailMerge\/","article_published_time":"2019-03-01T00:05:19+00:00","article_modified_time":"2020-10-07T05:52:07+00:00","og_image":[{"width":1685,"height":613,"url":"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2019\/02\/Gmail-Dangerous-Warning-Link-Wordzen-Com-web.png","type":"image\/png"}],"author":"Ajay Goel","twitter_card":"summary_large_image","twitter_creator":"@PartTimeSnob","twitter_site":"@GMassForGmail","twitter_misc":{"Written by":"Ajay Goel","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.gmass.co\/blog\/google-safe-browsing\/#article","isPartOf":{"@id":"https:\/\/www.gmass.co\/blog\/google-safe-browsing\/"},"author":{"name":"Ajay Goel","@id":"https:\/\/www.gmass.co\/blog\/#\/schema\/person\/b5fa74f8765b860701158fd77162fff8"},"headline":"Google&#8217;s Safe Browsing program made my week hell","datePublished":"2019-03-01T00:05:19+00:00","dateModified":"2020-10-07T05:52:07+00:00","mainEntityOfPage":{"@id":"https:\/\/www.gmass.co\/blog\/google-safe-browsing\/"},"wordCount":2012,"commentCount":11,"image":{"@id":"https:\/\/www.gmass.co\/blog\/google-safe-browsing\/#primaryimage"},"thumbnailUrl":"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2019\/02\/Gmail-Dangerous-Warning-Link-Wordzen-Com-web.png","articleSection":["In Depth How-To Guides","Interesting","Tracking Domain"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.gmass.co\/blog\/google-safe-browsing\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.gmass.co\/blog\/google-safe-browsing\/","url":"https:\/\/www.gmass.co\/blog\/google-safe-browsing\/","name":"Google's Safe Browsing program made my week hell","isPartOf":{"@id":"https:\/\/www.gmass.co\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.gmass.co\/blog\/google-safe-browsing\/#primaryimage"},"image":{"@id":"https:\/\/www.gmass.co\/blog\/google-safe-browsing\/#primaryimage"},"thumbnailUrl":"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2019\/02\/Gmail-Dangerous-Warning-Link-Wordzen-Com-web.png","datePublished":"2019-03-01T00:05:19+00:00","dateModified":"2020-10-07T05:52:07+00:00","author":{"@id":"https:\/\/www.gmass.co\/blog\/#\/schema\/person\/b5fa74f8765b860701158fd77162fff8"},"breadcrumb":{"@id":"https:\/\/www.gmass.co\/blog\/google-safe-browsing\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.gmass.co\/blog\/google-safe-browsing\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.gmass.co\/blog\/google-safe-browsing\/#primaryimage","url":"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2019\/02\/Gmail-Dangerous-Warning-Link-Wordzen-Com-web.png","contentUrl":"https:\/\/www.gmass.co\/blog\/wp-content\/uploads\/2019\/02\/Gmail-Dangerous-Warning-Link-Wordzen-Com-web.png","width":1685,"height":613},{"@type":"BreadcrumbList","@id":"https:\/\/www.gmass.co\/blog\/google-safe-browsing\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.gmass.co\/blog\/"},{"@type":"ListItem","position":2,"name":"Google&#8217;s Safe Browsing program made my week hell"}]},{"@type":"WebSite","@id":"https:\/\/www.gmass.co\/blog\/#website","url":"https:\/\/www.gmass.co\/blog\/","name":"GMass Blog","description":"Tips and tricks for sending mail merge and mass email campaigns directly from Gmail","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.gmass.co\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.gmass.co\/blog\/#\/schema\/person\/b5fa74f8765b860701158fd77162fff8","name":"Ajay Goel","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f3a70af05bbabe47925150d5a1320540e801b78055a74da20658fc97cd0706a2?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f3a70af05bbabe47925150d5a1320540e801b78055a74da20658fc97cd0706a2?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f3a70af05bbabe47925150d5a1320540e801b78055a74da20658fc97cd0706a2?s=96&d=mm&r=g","caption":"Ajay Goel"},"description":"Ajay is the founder of GMass and has been developing email sending software for 20 years.","sameAs":["https:\/\/twitter.com\/PartTimeSnob","https:\/\/x.com\/PartTimeSnob"],"url":"https:\/\/www.gmass.co\/blog\/author\/ajay-goel\/"}]}},"_links":{"self":[{"href":"https:\/\/www.gmass.co\/blog\/wp-json\/wp\/v2\/posts\/9020","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gmass.co\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gmass.co\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gmass.co\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gmass.co\/blog\/wp-json\/wp\/v2\/comments?post=9020"}],"version-history":[{"count":4,"href":"https:\/\/www.gmass.co\/blog\/wp-json\/wp\/v2\/posts\/9020\/revisions"}],"predecessor-version":[{"id":13734,"href":"https:\/\/www.gmass.co\/blog\/wp-json\/wp\/v2\/posts\/9020\/revisions\/13734"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gmass.co\/blog\/wp-json\/wp\/v2\/media\/9027"}],"wp:attachment":[{"href":"https:\/\/www.gmass.co\/blog\/wp-json\/wp\/v2\/media?parent=9020"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gmass.co\/blog\/wp-json\/wp\/v2\/categories?post=9020"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gmass.co\/blog\/wp-json\/wp\/v2\/tags?post=9020"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}