4 ms·
Oh, malarky. Here. I set up a page at http://lab2.gibsonandlily.com/google.html http://lab2.gibsonandlily.com/google.html Then I ran it through google transl
by blhack 15y ago
Oh, malarky.
Here. I set up a page at http://lab2.gibsonandlily.com/google.html http://lab2.gibsonandlily.com/google.html
Then I ran it through google translation services. Here is the result in apache's log:
74.125.16.18 - - [13/Jan/2012:10:45:37 -0600] "GET /google.html HTTP/1.1" 200 327 "http://translate.google.com/translate_p?hl=en&sl=fr&tl=en&u=http://lab2.gibsonandlily.com/google.html&usg=ALkJrhjD8_-6RDHslD53lf9XsYx2_J1q4A http://translate.google.com/translate_p?hl=en&sl=fr&... "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.75 Safari/535.7,gzip(gfe)
Look familiar? This one is tossing up windows NT, which is strange, but it doesn't seem like a stretch that some of the machines at google for stuff like this are running linux.
The scam here isn't being done by google, it's just a run-of-the-mill scammer scamming and using google's name.
Dearest mocotality. Turning on referals in apache logs and you'll see where on google this is coming from (if you care to).
Here is how:
in: /etc/apache2/apache2.conf (or whereever your apache configuration sits) change the "Logformat" option to the following:
LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
and then use option:
CustomLog /var/log/apache2/access_log combined
(or whatever log path you want).
- DEinspanjer 15y agoNot sure if I'd jump straight to malarky, but I definitely think it is very plausible that a scamming outfit is running the pages through translate, either as an obfuscation or actual translation.
- z92 15y agoThat sounds very plausible.
- powertower 15y ago> it's just a run-of-the-mill scammer scamming and using google's name A scammer selling a Google service for which their is no affiliate program? I wouldn't file this one away due to having a Google crawler on an IP address that’s on the same B block (that's like having the same car brand, not the same make/model)... An IP address that's not even related to the original investigation, but to some anecdote at the very end of the story. We need more info about the service being sold, and how it's being sold, who's the billing party, etc.
- blhack 15y agoThe scammer invented their own referral program by charging the businesses for a website. The only real tie to google here is that some person on a telephone used google's name.
- alexmuller 15y agoFrom the PDF transcript, page nine: Caller: No, it’s absolutely free, free of charge. Ok, there’s a small fee for hosting of Ksh. 200 per month. This seems like an incredibly simple scam, and it looks like blhack's nailed it. There is nothing connecting this to Google apart from that one IP address. I could phone up half a dozen companies and claim to be from Google, too. Hell, I get phone calls from "Windows Security Centre" every few weeks telling me to do something to my non-existant XP install.
- ma2rten 15y ago> Look familiar? This one is tossing up windows NT, which is strange, but it doesn't seem like a stretch that some of the machines at google for stuff like this are running linux. This is actually your user agent, isn't it? Google is probably forwarding your user agent string, so that you get a page that is optimized for your browser.
- blhack 15y agoThat's an excellent point, and actually complete's the loop on the story. The machines that this scammer is using run linux, which explains why the user agent reported this both when they were reading the pages directly, and when the started using google translate. Neat. I hope they follow up by taking my advice and including the referal so we get to see exactly where it's coming from.
- X-Istence 15y agoFor me it did forward my user agent.