<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Is Google Referrer Spamming Too Now?</title>
	<atom:link href="http://smackdown.blogsblogsblogs.com/2010/02/16/is-google-referrer-spamming-too-now/feed/" rel="self" type="application/rss+xml" />
	<link>http://smackdown.blogsblogsblogs.com/2010/02/16/is-google-referrer-spamming-too-now/</link>
	<description>Smackdown!</description>
	<lastBuildDate>Fri, 10 Feb 2012 01:20:31 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.2.1</generator>
	<item>
		<title>By: Weekly Search &#38; Social News: 02/23/2010 &#124; Search Engine Journal</title>
		<link>http://smackdown.blogsblogsblogs.com/2010/02/16/is-google-referrer-spamming-too-now/comment-page-1/#comment-35025</link>
		<dc:creator>Weekly Search &#38; Social News: 02/23/2010 &#124; Search Engine Journal</dc:creator>
		<pubDate>Tue, 23 Feb 2010 15:58:05 +0000</pubDate>
		<guid isPermaLink="false">http://smackdown.blogsblogsblogs.com/?p=463#comment-35025</guid>
		<description>[...] Is Google Referrer Spamming Too Now? – one of my fav ranters, Michael VanDermar picked up on some interesting goof-ups from the Google gang. This one was a fun ride and even the Googlers responded apparently. Give it a read. [...]</description>
		<content:encoded><![CDATA[<div style="background-color: #E4E8EB;">
<p>[...] Is Google Referrer Spamming Too Now? – one of my fav ranters, Michael VanDermar picked up on some interesting goof-ups from the Google gang. This one was a fun ride and even the Googlers responded apparently. Give it a read. [...]</p>
</div>
]]></content:encoded>
	</item>
	<item>
		<title>By: Michael VanDeMar</title>
		<link>http://smackdown.blogsblogsblogs.com/2010/02/16/is-google-referrer-spamming-too-now/comment-page-1/#comment-34771</link>
		<dc:creator>Michael VanDeMar</dc:creator>
		<pubDate>Thu, 18 Feb 2010 22:51:27 +0000</pubDate>
		<guid isPermaLink="false">http://smackdown.blogsblogsblogs.com/?p=463#comment-34771</guid>
		<description>@Robert - I posted an update with their reply a couple of hours ago, which does state that it is malware they are looking for, but I think I forgot to clear WP-Cache after I did so. My bad.</description>
		<content:encoded><![CDATA[<p>@Robert &#8211; I posted an update with their reply a couple of hours ago, which does state that it is malware they are looking for, but I think I forgot to clear WP-Cache after I did so. My bad.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Robert</title>
		<link>http://smackdown.blogsblogsblogs.com/2010/02/16/is-google-referrer-spamming-too-now/comment-page-1/#comment-34762</link>
		<dc:creator>Robert</dc:creator>
		<pubDate>Thu, 18 Feb 2010 20:47:18 +0000</pubDate>
		<guid isPermaLink="false">http://smackdown.blogsblogsblogs.com/?p=463#comment-34762</guid>
		<description>The reason they&#039;re doing this is to look for malware. Most of the time when a script is uploaded that contains redirects to malware it will only respond to specific referrers or browsers. This is because scripts will often chain together their redirects in an attempt to hide from researchers. 

This is particularly common with pages that are landing pages for google ads- malware authors will create the ads, have them point to a page that looks fine to the google bot but for someone with an exploitable browser, coming from the right place, the page will redirect to an exploit.

So, for example-

1) This page looks like an ad normally, but with the right into will redirect to 2
2) If the browser is exploitable and the referring was the original ad, redirect to 3
3-?) If the browser is exploitable and the referrer is correct, redirect to next
?+1) exploit the browser.

So its very important to find that initial page, since even if you know where the final exploit is you still need to have all the pieces to unlock it.</description>
		<content:encoded><![CDATA[<p>The reason they&#8217;re doing this is to look for malware. Most of the time when a script is uploaded that contains redirects to malware it will only respond to specific referrers or browsers. This is because scripts will often chain together their redirects in an attempt to hide from researchers. </p>
<p>This is particularly common with pages that are landing pages for google ads- malware authors will create the ads, have them point to a page that looks fine to the google bot but for someone with an exploitable browser, coming from the right place, the page will redirect to an exploit.</p>
<p>So, for example-</p>
<p>1) This page looks like an ad normally, but with the right into will redirect to 2<br />
2) If the browser is exploitable and the referring was the original ad, redirect to 3<br />
3-?) If the browser is exploitable and the referrer is correct, redirect to next<br />
?+1) exploit the browser.</p>
<p>So its very important to find that initial page, since even if you know where the final exploit is you still need to have all the pieces to unlock it.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Outtanames999</title>
		<link>http://smackdown.blogsblogsblogs.com/2010/02/16/is-google-referrer-spamming-too-now/comment-page-1/#comment-34754</link>
		<dc:creator>Outtanames999</dc:creator>
		<pubDate>Thu, 18 Feb 2010 16:08:07 +0000</pubDate>
		<guid isPermaLink="false">http://smackdown.blogsblogsblogs.com/?p=463#comment-34754</guid>
		<description>Hmm. Interesting observation in the log files. Still, it&#039;s difficult to know why this is occurring. However, is it possible that Google is spidering as IE6 to understand how some web pages may break under that version, especially given Google&#039;s move ?RKTML5 in its own apps?</description>
		<content:encoded><![CDATA[<p>Hmm. Interesting observation in the log files. Still, it&#8217;s difficult to know why this is occurring. However, is it possible that Google is spidering as IE6 to understand how some web pages may break under that version, especially given Google&#8217;s move ?RKTML5 in its own apps?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Michael VanDeMar</title>
		<link>http://smackdown.blogsblogsblogs.com/2010/02/16/is-google-referrer-spamming-too-now/comment-page-1/#comment-34743</link>
		<dc:creator>Michael VanDeMar</dc:creator>
		<pubDate>Thu, 18 Feb 2010 14:03:02 +0000</pubDate>
		<guid isPermaLink="false">http://smackdown.blogsblogsblogs.com/?p=463#comment-34743</guid>
		<description>@Mk - you&#039;d think so, right? But there are lots of things that Google does that don&#039;t live up to the standards we hold them to.</description>
		<content:encoded><![CDATA[<p>@Mk &#8211; you&#8217;d think so, right? But there are lots of things that Google does that don&#8217;t live up to the standards we hold them to.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Mk</title>
		<link>http://smackdown.blogsblogsblogs.com/2010/02/16/is-google-referrer-spamming-too-now/comment-page-1/#comment-34740</link>
		<dc:creator>Mk</dc:creator>
		<pubDate>Thu, 18 Feb 2010 13:45:13 +0000</pubDate>
		<guid isPermaLink="false">http://smackdown.blogsblogsblogs.com/?p=463#comment-34740</guid>
		<description>I think the informations and idea in this article are wrong.

If Google wanted really to do anonymous spidering with cloaked User Agents, they simply would buy new ips  and servers under another company name - instead of locking down reverse dns for some already bought ips in some google ip blocks. I mean we talk about Google not some wannabe-script-kiddies here.</description>
		<content:encoded><![CDATA[<p>I think the informations and idea in this article are wrong.</p>
<p>If Google wanted really to do anonymous spidering with cloaked User Agents, they simply would buy new ips  and servers under another company name &#8211; instead of locking down reverse dns for some already bought ips in some google ip blocks. I mean we talk about Google not some wannabe-script-kiddies here.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Michael VanDeMar</title>
		<link>http://smackdown.blogsblogsblogs.com/2010/02/16/is-google-referrer-spamming-too-now/comment-page-1/#comment-34627</link>
		<dc:creator>Michael VanDeMar</dc:creator>
		<pubDate>Wed, 17 Feb 2010 23:41:55 +0000</pubDate>
		<guid isPermaLink="false">http://smackdown.blogsblogsblogs.com/?p=463#comment-34627</guid>
		<description>Quick note to the inbred who was asking how I knew that the IP addresses belonged to Google... they are linked in the article. You can click on them and it will take you to the ARIN IP whois utility.

If you are going to try to call people out on the interwebs about technical shit then you should probably educate yourself a little bit better about how it all works first. Just a suggestion though. If you want to know why your comment wasn&#039;t approved, you can read about that here: &lt;a href=&quot;http://smackdown.blogsblogsblogs.com/2010/02/17/freedom-of-speech-and-social-media-a-quick-note-to-anonymous-commenters/&quot; rel=&quot;nofollow&quot;&gt;On Freedom Of Speech And Social Media (A Quick Note To Anonymous Commenters)&lt;/a&gt;.</description>
		<content:encoded><![CDATA[<p>Quick note to the inbred who was asking how I knew that the IP addresses belonged to Google&#8230; they are linked in the article. You can click on them and it will take you to the ARIN IP whois utility.</p>
<p>If you are going to try to call people out on the interwebs about technical shit then you should probably educate yourself a little bit better about how it all works first. Just a suggestion though. If you want to know why your comment wasn&#8217;t approved, you can read about that here: <a href="http://smackdown.blogsblogsblogs.com/2010/02/17/freedom-of-speech-and-social-media-a-quick-note-to-anonymous-commenters/" rel="nofollow">On Freedom Of Speech And Social Media (A Quick Note To Anonymous Commenters)</a>.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Michael VanDeMar</title>
		<link>http://smackdown.blogsblogsblogs.com/2010/02/16/is-google-referrer-spamming-too-now/comment-page-1/#comment-34610</link>
		<dc:creator>Michael VanDeMar</dc:creator>
		<pubDate>Wed, 17 Feb 2010 22:48:24 +0000</pubDate>
		<guid isPermaLink="false">http://smackdown.blogsblogsblogs.com/?p=463#comment-34610</guid>
		<description>Arthur, her being logged in is a separate issue than her traffic logs, but no, she wasn&#039;t.</description>
		<content:encoded><![CDATA[<p>Arthur, her being logged in is a separate issue than her traffic logs, but no, she wasn&#8217;t.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Arthur Czuma</title>
		<link>http://smackdown.blogsblogsblogs.com/2010/02/16/is-google-referrer-spamming-too-now/comment-page-1/#comment-34584</link>
		<dc:creator>Arthur Czuma</dc:creator>
		<pubDate>Wed, 17 Feb 2010 20:05:02 +0000</pubDate>
		<guid isPermaLink="false">http://smackdown.blogsblogsblogs.com/?p=463#comment-34584</guid>
		<description>This may be a silly question. But did she have personalized search enabled?

This will usually cause that kind of irregularity.</description>
		<content:encoded><![CDATA[<p>This may be a silly question. But did she have personalized search enabled?</p>
<p>This will usually cause that kind of irregularity.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Sebastian</title>
		<link>http://smackdown.blogsblogsblogs.com/2010/02/16/is-google-referrer-spamming-too-now/comment-page-1/#comment-34425</link>
		<dc:creator>Sebastian</dc:creator>
		<pubDate>Wed, 17 Feb 2010 00:50:53 +0000</pubDate>
		<guid isPermaLink="false">http://smackdown.blogsblogsblogs.com/?p=463#comment-34425</guid>
		<description>IF, and that&#039;s a big IF, Google&#039;s checking for cloaking pages with such blatantly faked requests, I&#039;d call that sneaky, too. As for the IPs you&#039;ve published, these could very well be assigned to AppEngine what opens just another can of worms, but has nothing to do with spam filters.</description>
		<content:encoded><![CDATA[<p>IF, and that&#8217;s a big IF, Google&#8217;s checking for cloaking pages with such blatantly faked requests, I&#8217;d call that sneaky, too. As for the IPs you&#8217;ve published, these could very well be assigned to AppEngine what opens just another can of worms, but has nothing to do with spam filters.</p>
]]></content:encoded>
	</item>
</channel>
</rss>

