Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Mobile Vulnerabilities

  • Zero-Day Alerts

  • Recent Posts

  • Calendar

    August 2015
    S M T W T F S
    « Jul    
  • Email Subscription

  • About Us

    Bad guys are always on the lookout for new ways of doing bad stuff. Today’s weird thing started when we looked at the top searches for terms in Google. One of them was aixirivali Andorra. Unfamiliar with the term, we googled it and discovered that everything about these words were either found on spam blogs or came from people wondering what those terms were. In short, nobody knows what it is but it’s a hot term.

    Actually, Andorra is a small little country in Europe between France and Spain but the other word didn’t make any sense.

    Looking closer at the Andorra map, there is a tiny town in the little country called “Aixirivall.” Ah, so whoever injected the random term into search engines misspelled it, too. The mastermind behind this move is not happy enough with hijacking popular search terms but also injected new made-up words into the popular list. We’re left to wonder what the shady intentions of this group may be. We think there are two likely possibilities:

    • They are trying to make the search term popular so their fake blogs can keep receiving visitors. When this strategy is used with real terms, Google will always prefer real legitimate websites like CNN or BBC mentioning them rather than some new site, which may host illegitimate redirections. If they invent a new term, there’s no competition, nobody talks about it except them so their fake results will top searches for sure.
    • They are trying to catch us, antivirus vendors, and other parties while monitoring the popular search list. If we follow links that aren’t supposed to be interesting for anybody else, they can tell us apart and block us.

    Well, whatever they’re up to, it’s shady for sure. And if you’re going to do something as foolish as injecting fake terms, at least make sure you spell them right.

    Share this article
    Get the latest on malware protection from TrendLabs
    Email this story to a friend   Technorati   NewsVine   MySpace   Google   Live   StumbleUpon

    • David Sancho (Advanced Threats Researcher)

      Hi Andrés:

      Thanks for the heads-up. That helps us understand why people were searching for those terms. The reasoning behind that malicious change was possibly linked to the SEO performed. If enough people look for the same thing at the same time and the term is very poisonous, a lot of users will be directed to malicious links.

      Again, thanks for the insight.


    • andres

      I think the reason why it's one of the number 1 google searches is because a lot of Facebook users noticed that every one of their friends who had a "home city" listed before now has the two words "Aixirivali, Andorra" in the place where the "home city" was. I noticed it on mine and spoke to some of my friends who noticed it on their Facebook account as well. So naturally the first thing I did was google "Aixirivali, Andorra" to find out what's going on with my Facebook account. I still haven't found out what's going on but there is obviously a problem with Facebook or with individual user's computers being infected by something.


    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice