home | legal stuff | glossary | blog | search

 Legend:  new window    outside link    tools page  glossary link   

The Google Redirect Hall of Shame

“...you've got to ask yourself a question: ‘Do I feel lucky?’
Well, do ya, punk?” (Det. “Dirty” Harry Callahan)

This page is by way of a small experiment.

Did you reach here because you clicked on a spam message? If so, you should be aware that this is NOT the spammer’s website, and I’m not going to offer you fake drugs or steal your credit card number. Count this as a wake-up call: STOP CLICKING ON SPAM LINKS!! You are doing nothing but inviting trouble for yourself and for the rest of us.

If you are still here, or if your interests run more toward the study of spam rather than the funding of same, then by all means read on. There isn’t much to read here, but you are welcome to read it if you like (especially if you are one of Google’s web-crawlers).

The inspiration for this page comes from this posting at the sans.org Internet Storm Center website, which gained some fleeting internet fame (and many admiring fans) in September, 2007. It seems that Bojan Zdrnja of sans.org was reporting on a new trend in spam website redirection, namely, the use of Google’s “I’m Feeling Lucky” (IFL) URLs. In describing how spammers put text on their pages that is calculated to make them turn up first in an IFL query, he, um, inadvertently began turning up first in the spammers’ IFL queries. In other words, he essentially hijacked the spammer’s web traffic without even meaning to do so (!). (Later I will be adding some more information about how this works, but for the moment you can get the details at the aforementioned sans.org article.)

So, I have decided to try the following: each time I receive a spam containing a Google IFL link, I will post the link (and the query terms) on this page. The page will be linked from my index page in order that it should be crawled by Google.

2007-09-28 Pharma Spam
http://www.google.com/search?q=myvisameds&btnI=ec
Query: myvisameds
Target: www.myvisameds.com/viewcart.php (botnet hosted)

2007-09-29 Pharma Spam
http://www.google.com/search?q=myvisameds&btnI=ec
Query: myvisameds
Target: www.myvisameds.com/viewcart.php (botnet hosted)

2007-09-30 Pharma Spam
http://www.google.com/search?q=myvisameds&btnI=ec
Query: myvisameds
Target: www.myvisameds.com/viewcart.php (botnet hosted)

2007-12-27 Pharma Spam (2 instances)
http://www.google.com/search?q=domain2find+tabs+unbelievable&btnI=ec
Query: "domain2find tabs unbelieveable"
Target: www.domain2find.org (hosted at 202.108.201.20 in GUANGHUAN-NETWORK-CO block)

2007-12-29 Pharma Spam
http://www.google.com/search?q=domain2find+first+time&btnI=ec
Query: "domain2find first time"
Target: www.domain2find.org (hosted at 202.108.201.20 in GUANGHUAN-NETWORK-CO block)

2007-12-30 Pharma Spam
http://www.google.com/search?q=economic-quality+welcome+to+us&btnI=ec
Query: "economic-quality welcome to us"
Target: economic-quality.com (hosted at 202.108.201.20 in GUANGHUAN-NETWORK-CO block)

2008-01-05 Pharma Spam
http://www.google.com/search?q=domain2find+welcome+to+us&btnI=ec
Query: "domain2find welcome to us"
Target: domain2find.org (hosted at 210.14.129.233 in ZBYD block)

2007-01-10 Pharma Spam
http://www.google.co.ls/search?hl=en&q=greatcanadianpharm+item&btnI=I=L8YR
http://www.376006.com/search?hl=en&q=greatcanadianpharm+item&btnI=I=Ai1JsA
http://www.google.co.id/search?hl=en&q=greatcanadianpharm+item&btnI=I=tmI9
Query: "greatcanadianpharm item"
Target: greatcanadianpharm.com (hosted on botnet, 15 addresses responding)

2008-01-11 Pharma Spam
http://www.googlr.com/search?hl=en&q=greatcanadianpharm+item+php+639&btnI=I=FMgG5
http://www.google.co.ke/search?hl=en&q=greatcanadianpharm+item+php+639&btnI=I=owhr
Query: "greatcanadianpharm item php 639"
Target: greatcanadianpharm.com (hosted on botnet, 15 addresses responding)

2008-01-13 Penis Enlargement Spam
http://google.co.kr//search?hl=en&q=VPXL%2BMade%2BEasy%2Brkcerock.com&btnI=grandnephew
Query: "VPXL+Made+Easy+rkcerock.com"
Target: rkcerock.com (hosted at 119.18.192.47 in WEEK5 block)



 Legend:  new window    outside link    tools page  glossary link   

(c) 2003-2007, Richard C. Conner ( )

07286 hits since March 27 2009

Updated: Sun, 13 Jan 2008