Shopify support are telling us to speak to Google ads (regarding ad disapprovals caused by their flag for ‘malicious content’) and saying Google are having a lot of ‘false flags’ at the moment - That doesn’t really hold water though as my browser guard (which has nothing to do with Google) is flagging the clients site for containing a trojan!
Update: We found the culprit app for ours, it was pop up app used to notify international users of being on the wrong site. Doesn’t seem like it was isolated to the Yandex app.
I have not looked into the clients account, I just found it very suspicious I got a lot of emails in one day about the same issue. Which signals a global issue.
When I first looked at it, the subdomain was geo, which I thought was related to a GEO app, but the second subdomain does not make sense.
It is entirely possible several apps have been hacked, not just one.
And yes, this is not a Google issue, I’m using bitdefender that is detecting the issue, which has nothing to do with Google.
And the URL itself is redirecting, which should not be the case if it was a real app.
We were also having the same issue and contacted Shopify support. They were able to look in the backend of our store and told us the culprit was an app called “Geo Targeting - Notify pop-ups”. We deleted it and the script from asaplabs was gone after that.
These were the details shared by the Shopify rep:
It seems like it is coming from a third party app - in your case, it is coming from the “Geo Targeting - Notify pop-ups” app. It is suggested that you remove it and revoke any access they have.
When we search on the back end through installed apps on the store, this one has “asaplabs” in the script URL
Only we have access to this back end, it’s like a “profile” of all stores.
Since only Shopify can see the scripts of all apps installed I would suggest anyone facing this issue goes to the chat and ask for their assistance.
There is one other app I’ve found a record of being developed by Simtech called “Custom JavaScript & jQuery” which I would assume also could be affected:
We’ve removed the geotargeting app from the site now, and I’m no longer getting the flags from my browser guard. Unfortunately Google doesn’t agree the issue is resolved and our ads are still suspended
@James-Does-PPC Google unfortunately uses website caches to verify Malicious Software. Which means you need to wait until the cache in Google are cleared of the old plugin.
Yes this is annoying. Please note I am aware of this process only for Google Ads, I do not know if this is the same for Google Merchant Center.
You can check when a page is cache by adding cache: in front of your URL.
Interesting, I wonder if that is where the app was redirecting to. I have scanned the site it was going to using a 3rd party tool and it came up clean.
Yes I did use our site, rather than yours (appreciate the check though, you never know!)
Any experience with how often the pages are crawled?
Crawl rates are increased or decreased by Google dependent on the volume of traffic you get. The more popular your website is, the higher the crawl rate.
Thank you for posting this. I spent 2 days trying to find a solution to this problem. My Google Search Console was showing me a lot of pages with soft 404 and it was growing every week.
Deleting “Geo Targeting - Notify pop-ups” did the trick for me. The app was disabled but still present. I remember disabling it because it was causing other problems for me.
We have also been battling with Google Ads since mid June 2022, malicious content and soft 404. We had the Yandex app installed and removed the app and also removed any scripting associated with it manually from the theme. Yandex and asaplabs and some related apps have been compromised. However, once we removed the code, Google still was denying our ads. Google on their end, needs to clear their cache! That’s right. If you take an example page of your website that is being flagged, type in cache:https://xxyourwebsitelinkxx and take a look at the google cache date. The deleted code may still be present in their scanning and they HAVE to refresh their cache or they will still be detecting the code!
