Your Fake Antivirus Don't' Protect You

The report describes an SEO poisoning campaign where many Google search-result links redirected users to fake anti-virus (fake AV) pages (notably www1.bestdefender-51p.xorg.pl and www1.bestdefender-68p.xorg.pl). It documents that browser protections (Google Safe Browsing, SmartScreen) and common antivirus plugins often failed to flag these pages, that several links on a popular search result page were malicious, and that the malicious payload had low detection rates on VirusTotal (example: 12/41 vendors detecting the sample). The author reported the domains to Google and observed inconsistent blocking across browsers and search engines.