[TUT and CODE] How to Fake your Referer, Fake Referer Any Offer, Fake Referrer Script

[JohnsonDaniel]

Exactly what I've been searching for.

Waiting eagerly for the update.

There will be no update to this, as it's 100% complete.

There "may" be a blanker script, similar to this one, shared once it's completed. It's almost ready, but it's not quite 100% yet.

 

[redsecond]

Ow, the blanker scripts works like a double meta refresh then?

 

[JohnsonDaniel]

Ow, the blanker scripts works like a double meta refresh then?

The end result is similar, although better, in that your traffic arrives with no referers, but DMR is so...Yesterday!

 

[Percu]

First of all: Thank you!
One more time, very nice share.

So the deal is: BH website which receives junk trafic --> Domain with the script which redirects --> WH website, used as referer --> CPA offer.
Am I right?

I tried it like that and it was ok for me, I just checked the referer with firefox ref control, and the WH website appeared.

Then, I wondererd if it was possible to mix BH website and domain which redirects as one website.

I saw in the code there is a condition. So I just took the index.php file of my website, copied everything and added the code in your first code here:

} else {
    Code from index.php website
}

It actually works if you arrive on direct (no referer) on the website of course, and if you have only one page (as if you click, a referer will appear, so the script will be on) so it's actually useless

I wondered if it would be possible to disable the script for people navigating on the website (so for people having the website itself as referer).
It would be usefull for people who don't want to use an entire domain just for the redirection.
But I'm actually not sure it would be nice ... as in your code there is a double protection (domain which redirects and WH website).

So my conclusion: very nice script, which seems to have a high level of protection, so it's better to use it as you describe and not trying to mix BH website with the redirection.

Edit: I also tested your code with CakeSlice for people who wants to Iframe CPA offer, it seems ok, even if I don't checked the Iframed ref (any way to check the referer in an iframe?)

Edit2: I simply added the index.php in a subfolder of my BH website, as suggested by Etrader, and that's ok it works. The deal can be: BH website with script --> WH website for referer -->CPA offer and the URL has to be like this one:

http://handler.com/SubFolderWithScript?url=myCPAnetwork.com?oid=12345&pid=6789&sid=yy7456&referer=myfavewpsite.com/post-with-ads

 

[JohnsonDaniel]

First of all: Thank you!
One more time, very nice share.

YW

Then, I wondererd if it was possible to mix BH website and domain which redirects as one website.

Do you mean host the WH site on the handler domain? I hope so, because you don't want any of this, the handler domain, nor the WH site, to have anything at all to do with your BH site (the site where the links are).
If you mean the WH site then yes, you can use the handler domain as an index.php in a folder, with the whitehatsite on the root, like this:

Your choice of Handler Domain: whitehatsite.com/trakz

Your WH website: whitehatsite.com

Your links (to place on a BH site):

http://whitehatsite.com/trakz/?url=http://offerurl.com&params=values&referer=http://whitehatsite.com

or, if using a page or a post as the fake referer:

http://whitehatsite.com/trakz/?url=http://offerurl.com&params=values&referer=http://whitehatsite.com/thePageorthePost

Edit: I also tested your code with CakeSlice for people who wants to Iframe CPA offer, it seems ok, even if I don't checked the Iframed ref (any way to check the referer in an iframe?)

Afaik, but I haven't used cakeslice in a while, you're not actually iframing the destination page, you're slicing it, and hosting the slice yourself.
If you then route the Submit button to the offerurl using the construction above, you should be fine. But someone more familiar with Cakeslice can jump in and correct me if I'm wrong on this one...

 

[Percu]

I was really talking to host the script on the BH site. The final result would be the same for the AM for example as in his report, he would see the WH as referer.

But, as you said, it would be less safe as the BH website could be seen as a trafic source of the WH site.

So, the best is indeed to use your script as you said. It's really the most safe I saw until now, congrats one more time!

 

[denrou]

How would I make my traffic noref? Is there any good traffic provider that would be selling noref traffic?

 

[redsecond]

More questions:

If we put the script as-is on the website, it'll be easy to check manually through the code right? Is there any way for the code to be encrypted or something?

 

[Percu]

More questions:

If we put the script as-is on the website, it'll be easy to check manually through the code right? Is there any way for the code to be encrypted or something?

No, the script doesn't appear in the code, that's why it's better than other fake scripts.

As JohnsonDaniel explained:

Also, unlike other fake ref systems, with this one, go and have a look at the source code of myfavewpsite.com/post-with-ads...which is what will be shown as your referer.

 

[redsecond]

Oh, I mean this one Percu,

You're right There is a tiny, infinitesimal chance, that there could be an occasional leak. If there ever was, though, which is doubtful, at most it would leak the handler domain, and never, ever, the original domain that the link was clicked on.

If the guy see the source code of the handler domain, the index.php, it'll be better if we encrypt it right?

One more thing, if, and if, the am is suspicious about the BH site, and try to see the code for the click, is there anyway to avoid giving away the command there?

 

[KlaAz0r]

thank\ you for the share : )

 

[Percu]

Oh, I mean this one Percu,

If the guy see the source code of the handler domain, the index.php, it'll be better if we encrypt it right?

One more thing, if, and if, the am is suspicious about the BH site, and try to see the code for the click, is there anyway to avoid giving away the command there?

Sorry, I didn't get it. In my opinion, if the AM check the handler domain, he would only see something like:

<html><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"></head><body> 
    <form action="/index.php" method="post" id="myform"> 
    <input type="hidden" name="ref_spoof" value="/index.p"> 
    </form><script language="JavaScript"> document.getElementById('myform').submit();</script></body></html>

That's what I see when I do : view-source http // www handler com index php
So maybe we should just change the name of the script (as ref spoof is suspicious ). It has to be confirmed, I'm not sure about that.

YW

Afaik, but I haven't used cakeslice in a while, you're not actually iframing the destination page, you're slicing it, and hosting the slice yourself.
If you then route the Submit button to the offerurl using the construction above, you should be fine. But someone more familiar with Cakeslice can jump in and correct me if I'm wrong on this one...

I think to slice the offer and to change the URL inside the iframe with the URL built with your script should be enough, it has to be confirmed too .

 

[JohnsonDaniel]

Guys, remember that the chance of the handler domain leaking is infinitesimal...

Nevertheless, if it did, and were visited, the index.php is just a self-posting form, you can't see source unless you escape it, and stop it, and, if you do that, then you WILL see the form as Percu posted it.

ref_spoof can be changed, but, whatever you change it for, make sure to also change it in the code you paste into the sites and pages you're using as your fake refs, or it'll stop working.

The blanker's ready

 

[cynic]

MAn this is one sweet powerful post right here. I'm still working out a few kinks and all but once I get it down . I can see the potential to make a furious killing with this....Funny anough I can make more sense of this than CPAR or other fake referrer methods.

Now If I can only figure out how to merge this with an iframe with absolute posistions and fake referer the code within that iframe.

 

[Percu]

Yes, very nice job from Johnson Daniel. Obviously the best fake referer script I saw: many level of protection.

I will try it on an offshore host and keep you update.

 

[Donnie Darko]

So I have a really odd problem. The script is working and all, however, I'm being redirected to the address in the referer parameter.

Basically, when I do this:

http://handler.com/?url=http://google.com&ref=http://bing.com

I end up on bing.com instead of google.com :/ What may be the problem?

 

[Percu]

So I have a really odd problem. The script is working and all, however, I'm being redirected to the address in the referer parameter.

Basically, when I do this:

http://handler.com/?url=http://google.com&ref=http://bing.com

I end up on bing.com instead of google.com :/ What may be the problem?

Try with &referer not &ref

 

[Donnie Darko]

Try with &referer not &ref

I've edited the code to work with ref, so that shouldn't be the problem.

 

[Percu]

I just re-read your post ... you can not get Bing.com as referer because it's not your site. (or is is just an example for this post?)

You have to be the owner of the website you want to appear as the referer because you have to add the second script on it.

 

[JohnsonDaniel]

So I have a really odd problem. The script is working and all, however, I'm being redirected to the address in the referer parameter.

Basically, when I do this:

http://handler.com/?url=http://google.com&ref=http://bing.com

I end up on bing.com instead of google.com :/ What may be the problem?

Percu is correct. The only way this will add the fake referer to your visitors is if you add code to the site which you wish to appear as the fake referer.
As Bing is not yours, you can't add the necessary code to it, so it's not gonna play ball