Google Ads says my site is affected by an unsafe domain

I'm working with a client's marketing team who just got this message from Google: The most recent system scan detected that this advertiser's primary declared landing page is affected by an unsafe domain and the bad link is 'googie-anaiytics[.]com'

Note the lowercase i in place of the two lowercase Ls in the link.

We've looked in the source code, Google Search Console, Ahrefs, Google Analytics, and Screaming Frog and we don't see any reference to or from that spammy domain to the client's Home page. I've found the same question posted in other forums, but no answers.

Has anyone solved an issue like this?

Hello there, we encountered the same problem. It is caused by a compromised library, polyfill. You will need to remove all instances of polyfill in your website for it to work normally.

Thank you @HoangExprto. I'm not sure what a polyfill is or where to find it. Would it be in a code injection? Custom CSS?

Dear Amy,

I am a website malware security professional. Could you share link to your website for me to have a look?

Thank you @WebQure. It's https://www.blacksford.com/

It is a javascript file. I am not sure if you have removed anything after the warning, but the only file I see related to polyfill left in your site is //assets.squarespace.com/@sqs/polyfiller/1.6/modern.js . You can remove this file and submit again to see if it is the issue.

@HoangExprto thank you. I don't believe I can remove that from a Squarespace site, but I'll check with my developer to see if they can. I appreciate your help.

Quote

I don't believe I can remove that from a Squarespace site

You can't. If you didn't install it, you can't remove it. Squarespace does not allow access to their backend.

@creedon how do you remove it then?

On 6/21/2024 at 8:13 PM, AmyF said:

Thank you @WebQure. It's https://www.blacksford.com/

Thanks. Squarespace doesn't allow access to their source code so you can't remove or delete any such code from the website. Could you share site access with me for a detailed in-depth review of  this website? I think I can resolve his issue.

On 6/21/2024 at 1:16 AM, AmyF said:

just got this message from Google: The most recent system scan detected that this advertiser's primary declared landing page is affected by an unsafe domain and the bad link is 'googie-anaiytics[.]com'...we don't see any reference to or from that spammy domain to the client's Home page

I didn't see the unsafe domain referenced in the site code either.

Hi, it is me again.

After some digging, I finally found a page that is using polyfill: url https://www.blacksford.com/yellowstone-rv-rentals containing polyfill library https://cdn.polyfill.io/v3/polyfill.min.js?features=URL,Promise,Symbol,Symbol.iterator,Object.assign,Object.values,Object.entries,String.prototype.startsWith,String.prototype.endsWith,Intl,Intl.~locale.en-US,Intl.~locale.en-CA,Intl.~locale.fr-CA,Intl.~locale.en-AU,Intl.~locale.en-NZ&flags=gated . Please remove this.

Do note that this might not be the only page containing polyfill library, you will need to scan ALL of your pages.

@HoangExprto Thank you !
Can you help me to know how did you found the root cause - polyfill library.

Do you have any scanner to check your site ?

Did google responded you back with the infected library in polyfill that contains googie anaiytics or else do you observe any redirection to suspicious domain with polyfill?

Thank you for your help !

@HoangExprto Thanks for taking a look. I see polyfills referenced on every page of the site in these lines of code:

<script type="text/javascript" crossorigin="anonymous" defer="defer" nomodule="nomodule" src="//assets.squarespace.com/@sqs/polyfiller/1.6/legacy.js"></script>
<script type="text/javascript" crossorigin="anonymous" defer="defer" src="//assets.squarespace.com/@sqs/polyfiller/1.6/modern.js"></script>

Is that different than what you found on the page you referenced (https://www.blacksford.com/yellowstone-rv-rentals)? I see this code on the 50+ Squarespace sites I'm on.

Because the source is from Squarespace itself—src=//assets.squarespace.com—I'm assuming it's from Squarespace's server code. And (for good reason) it's not accessible, deletable or editable by customers.

For other Squarespace customers having this issue, read below to see what Squarespace support said:
 

Quote

I understand Google Ads is stating that their domain is being affected by an unsafe domain: googie-anaiytics.com. I'm sorry to hear of the trouble.
 
In regards to the solution provided by the forum user of removing the polyfill library from the platform's code, I do want to clarify that it isn't possible to edit or modify the platform code. You may inject code into a Squarespace site, but it isn't possible to change the server code used for the Squarespace platform.
 
I understand this may not quite be the answer you were hoping to hear - we value transparency and your time, so we want to be as up front as possible with you on what can and cannot be done within our platform.
 
On this note, I've taken some time to review the site and haven't been able to locate any links or instances of code pointing to an unsafe domain: googie-anaiytics.com. 
 
I've done some research on this and it seems that malicious links can be hidden in plugin files. Typically, these are integrated via custom code.

That said, I've noticed that the site has Developer Mode enabled, as well. Using the Developer Platform provides you with full access to your template code and allows you to create a custom template from scratch using the Base template. 
 
After you enable developer mode, you have full access to the template code (CSS, JSON, and HTML). Can you confirm if you've been able to inspect your template code for the URL being reported as unsafe?

I'll look into the code added via Developer Mode, but most of it relates to CSS and styling, so I can't imagine that's the issue.

Just ignore //assets.squarespace.com/@sqs/polyfiller/1.6/legacy.js and //assets.squarespace.com/@sqs/polyfiller/1.6/modern.js. I initially thought that since it is the only polyfill thing in your website, it might be the cause. But since the customer support has confirmed that they are hosted locally, we can be somewhat confident in their safety.

In the URL https://www.blacksford.com/yellowstone-rv-rentals I found an url not hosted locally https://cdn.polyfill.io/ . This URL has been sold to a shady Chinese company https://github.com/formatjs/formatjs/issues/4363 , and Cloudflare has issued a warning https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-your-supply-chain-risk , though only now does the domain starts to spread malicious code. So you should consider removing it.