[cd34]

While safewatch was/is a good concept, due to a few limiting factors of the way google publishes data, the root domain in cleo's case was not tagged, only the /tgp/ directory.

It is still a good indicator since 99% of the malware will be present on all pages.