Social engineering content detected on your website by Google

[haifa]

Today (July 6, 2016) I received a message from Google saying that my website was detected for Social Engineering. If this issue happens to you, the usual 99% is caused by advertisement. Some ads company serve ads that try to phish for sensitive information. Usually removing the ads will get back your website green with Google.

However, if you hosted your website with HostGator, then you have to listen closely. I just spent the last 1 hour with HostGator support to clarify the issue.

It appears that there is some shady account in HostGator trying to take advantage of HostGator so-call "temporary address" and using that trying to spoof other people account.

What these shady people do is trying to inject ads into your website and eventually end up with Google issue you a message through Webmaster Tool. If this happens to you, here is the steps you should follow:

1) View the reason (usually in the form of a URL) that Google claimed your website had social engineering content on it.

2) Visit the URL(s) and take note of whether or not the page exists or if it's 302 redirected to a page ending in suspendedpage.cgi (this means that HostGator resolved the issue for you already).

3) Contact your web host (in our case, HostGator) and have them help you out with the issue so that you can get more information on it. You might have to nudge them for an hour, but eventually, you'll have a regular and senior agent provide you information on what exactly happened.

4) Before you send in an appeal to Google, use the Fetch as Google tool (fetch and render) on the URL's Google finds suspicious and ensure that what the Google bot is seeing is the same thing you're seeing.

5) Once that's done, send in your appeal through Search Console and explain that you the page has already been removed successfully, and you've secured your website from future attacks (don't lie and beef up your web security).

6) Wait up to 72 hours for Google to approve/deny your appeal. If the suspicious pages have been removed, they'll approve the appeal.

In your case, you mentioned a file being the case of the issue, so you'll need to contact your web host and, if you're nice about, they'll comb through all of your files for you and let you know if they find anything.

I found these step from another forum. Thank you to Zwielicht from Black Hat World.

Hope these info help you guys!