Bad Link - detected by google

[4rwino]

Google disapproved all our ads due to a bad link.

Can't seem to find it anywhere in our shop code and etc.

Anyone able to help with this?

Investigation:

• After checking your query and account with our dedicated team, the most recent system scan detected that the primary declared landing page is affected by an unsafe domain.  
• bad link: xxxxx

[ritoms332]

Just received this email:

Action Required: Security issue affecting your landing pages

Dear Advertiser,

We've detected a security issue that may be affecting websites using specific third-party libraries (like polyfill.io, bootcss.com, and others). This issue can sometimes redirect visitors away from the intended website without the website owner's knowledge or permission.

Because your Google Ads are linked to websites XXXXXX that might be using these libraries, we want to make you aware of the situation as it may result in Ad disapproval.

Why is this happening?

The code causing these redirects seems to be coming from a few different third-party web resource providers including Polyfill.io, Bootcss.com, Bootcdn.net, or Staticfile.org. Similar reports can be found by searching for "polyfill.io" on Google (https://www.google.com/search?q=polyfill.io).

What does this mean for your Google Ads?

If we find these redirects during our regular checks of your ad destinations, we'll need to disapprove the related ads. This is due to our Compromised Sites Policy, which aims to protect users from websites with unauthorized code modifications.

What can you do?

Investigate your landing pages: Check your website's code (or ask your website administrator) to see if you're using any compromised libraries.
Remove or replace the code: If you find compromised libraries, consider:
Hosting a clean, secure version of the code yourself
Switching to an alternative library or provider
Resubmit your ads: Once you've fixed the issue, resubmit any disapproved ads for review.

We understand this might be inconvenient, but our priority is to keep both advertisers and users safe. We appreciate your understanding and cooperation.

[4rwino]

An update from google!!

Investigation: 

Upon thorough investigation of your ads account, I'm pleased to share that the most recent scan shows that the domain is enabled on our end and is free from malvertising violations. 

So basically no issue from our end. Ads have been approved again.

[ritoms332]

Great to hear -  did you remove just pollyfill library or something else? 

What link you have used to contact Google Support? and did you submit new sitemaps? 

Thanks.

[kpopm]

I also run a website using shopify.(I am beginner.)
Where can I find the polyfil code?

Please let me know how to remove pollyfill library code.

Thank you

[ImStillLearning]

May I ask how you were able to find the malicious content?
I have just gotten this email. I did a scan and its all clear.

Thank you

[easttung]

i have got the same email as well, dont know how to solve it

[bryan76]

do you have any instances of polyfill within your sites?

[ritoms332]

SOme updates about this issue:

https://sansec.io/research/polyfill-supply-chain-attack

More then 100  000 sites comromised

[needy]

hi, is there any new update on these issues?

[bryan76]

do you have any instances of polyfill within your sites?

[TyW · Accepted solution]

Hi! I wanted to share that this issue has been addressed.

Please note however that you must manually remove any references to polyfill.io in your theme.  

I'm going to mark this as the solution to aid with awareness - thanks again all for your feedback on this as well! 

[KotarskiMedia]

I see there's issue identified, however I DO NOT see a solution per se...

[YellowstoneDigM]

The solution is to remove the polyfill.io links