[TUT and CODE] How to Fake your Referer, Fake Referer Any Offer, Fake Referrer Script

[Donnie Darko]

Yeah I don't even know why I didn't test it with a page on my server anyway. Spent like 30 minutes trying to figure out why the heck it was doin' that..

 

[cynic]

http://handler.com/trakz/?url=http://offerurl.com&params=values&referer=http://domianB.com

So I bit the bullet and decided to iframe using the above url structure and host it on handler.com. I just wanted to see if it would load up properly and LOAD UP it did!!!

My question is does the iframed offer leak traces of the handler.com domain ?

 

[JohnsonDaniel]

http://handler.com/trakz/?url=http://offerurl.com&params=values&referer=http://domianB.com

So I bit the bullet and decided to iframe using the above url structure and host it on handler.com. I just wanted to see if it would load up properly and LOAD UP it did!!!

My question is does the iframed offer leak traces of the handler.com domain ?

For an iframed page to "know" which page is iframing it it can use the "top" location property.

This script manipulates the http "referer" property, so I suspect the site you are iframing, IF it's using the correct code, "could" find out it's being framed by your handler.com domain.

I wouldn't be hosting it on handler.com, and I'd iframe a site with code to track iframers, and see what gets reported in my logs on that site, to know what's going on, prior to using what you have posted.

 

[Percu]

I think that if you iframe the page witch cakeslice for exemple and that you replace the URL in your iframe code by the one made with this script, it should be ok, as there would be a redirection directly inside the iframe.

 

[HostStage]

Do the faked hits pop out in Google Analytic ?

 

[redsecond]

So after trying it on my sites, I noticed that before you're redirected to the offer url the address bar shows the whitehat site. Can this be changed?

If an AM were to check the BH site, and click on the link, it'll show process of redirection right?

 

[nECA_BG]

So after trying it on my sites, I noticed that before you're redirected to the offer url the address bar shows the whitehat site. Can this be changed?

If an AM were to check the BH site, and click on the link, it'll show process of redirection right?

And how would the AM know the BH site? That's why were are faking the referer of the BH site

 

[JohnsonDaniel]

Do the faked hits pop out in Google Analytic ?

Well, in order for your redirected traffic to carry the faked/wh site as the referer, it does get redirected VIA the wh site.
Therefore, I'd imagine those hits WOULD appear on Google Analytics.
But, then again, it's your site so, supposedly, only you should see the analytics or tracking installed on it.

 

[bhaffiliate28]

Has anyone tried this inside an iframe for CPA ads?

Also, it seems pretty obvious to the naked eye if you have a link on your site like

<a href="www.mysite.com/?url=myAdlink.com&referer=mysafewebsite.com">click me I am an advertisement</a>

Just hovering over the link you would see the browser status report back your redirect link. Just my 2 cents.

but I am definitely curious how well this works if I need to set the source of an iframe to this. I will have to test.

 

[bhaffiliate28]

Ok, I just ran an iframe test. I haven't verified my stats and the referrer but I do get a "File not found".

I have some unique htaccess rules applied, so the URL has to be specific to a certain format...any extra characters will bomb it. In this case, the site looks similar to a mediafire link

mysite.com?cp08pae6mrcq except this referrer script is doing this

mysite.com?cp08pae6mrcq=

and the = symbol kills it.

I also ran this code using one of my wordpress blogs, and though I got redirected properly to my website after clicking my test link, it came through as something like

I've removed the HTTP part of my urls

mysite.com/2011/07/06/postname/?ttp%3A%2F%Fmysite.com%2f2011%2F07%2F06%2Fpostname/=

which seems jacked...seems like it should have taken me to

mysite.com/2011/07/06/postname/

thoughts?

 

[Percu]

That's ok with cakeslice.

Try something like that:

<div style="overflow: hidden; width: 251px; height: 117px; position: relative;" id="i_div">
<iframe name="i_frame" src="[COLOR="Red"]http://handler.com/?url=DestUrlIncludingParameters&referer=FakeRefUrl[/COLOR]" 
style="border: 0pt none ; left: -857px; top: -31px; position: absolute; width: 1680px; height: 955px;" scrolling="no"></iframe></div>

 

[bhaffiliate28]

For an iframed page to "know" which page is iframing it it can use the "top" location property.

This script manipulates the http "referer" property, so I suspect the site you are iframing, IF it's using the correct code, "could" find out it's being framed by your handler.com domain.

I wouldn't be hosting it on handler.com, and I'd iframe a site with code to track iframers, and see what gets reported in my logs on that site, to know what's going on, prior to using what you have posted.

Hey JohnsonDaniel,

I just tested my iframe and confirmed my stats reported back the correct referrer!

My iframe looks like this (removed HTTP)

<iframe src="stats.handler.com/?url=:fakeadwebsite.com&referer=download.mysite.com/" width="100%" height="800" frameborder="0"></iframe>

and fakeadwebsite.com loaded in the iframe. I went and looked at my stats related to fakeadwebsite.com and it came through as download.mysite.com

so I do believe as long as the ad network has no knowledge that your "bad" website exists, using the code above "should" prevent them from ever seeing it as the referrer.

Would love some other input on this specifically tied to iframes. Of course, if the ad network has a framebuster enabled, who knows.

As mentioned earlier, the "fakeadwebsite" in my case was one of my wordpress blogs and I get a bunch of ugly junk added to the URL once I land on the page

?ttp%3A%2F%2Fwww.fakeadwebsite.com=

EDIT - saw Daniels post above with the new code.

 

[JohnsonDaniel]

Hey JohnsonDaniel,

I just tested my iframe and confirmed my stats reported back the correct referrer!

My iframe looks like this (removed HTTP)

<iframe src="stats.handler.com/?url=:fakeadwebsite.com&referer=download.mysite.com/" width="100%" height="800" frameborder="0"></iframe>

and fakeadwebsite.com loaded in the iframe. I went and looked at my stats related to fakeadwebsite.com and it came through as download.mysite.com

so I do believe as long as the ad network has no knowledge that your "bad" website exists, using the code above "should" prevent them from ever seeing it as the referrer.

Would love some other input on this specifically tied to iframes. Of course, if the ad network has a framebuster enabled, who knows.

As mentioned earlier, the "fakeadwebsite" in my case was one of my wordpress blogs and I get a bunch of ugly junk added to the URL once I land on the page

?ttp%3A%2F%2Fwww.fakeadwebsite.com=

EDIT - saw Daniels post above with the new code.

Yep, it definitely works for iframes, but the issue is that many CPA offers are set to bust out of them.

As for links, generate them, and then run them through a decent shortener. Now they'll no longer look so obvious
An alternative is to code them so they don't display the destination url in the status bar when hovered over.

The junk, yep, happens when the link has no parameters, and yep, replacement code to be pasted into sites/pages acting as spoofed refs was posted later in the thread, as I was unable to edit the OP. Glad you found it

 

[cynic]

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>
<style>
body{
width:1000px;
margin:0 auto;
}
</style>

<body>
<iframe id='bframe'  name='bframe' src='http://www.fatcatrewards.com/uk/bonuscash/?l=50' align="left" style='border: 0pt none ; float:left; width: 500px; height: 649px;' scrolling='no'></iframe>
<iframe id='bframe'  name='bframe' src='http://www.fatcatrewards.com/uk/bonuscash/?l=50' align="left" style='border: 0pt none ; float:left; width: 500px; height: 649px;' scrolling='no'></iframe>


</body>
</html

so if my iframe has absolute positions ie the above, how do I go about putting it to the right or the middle of the page ?

I used Ghostcpa to iframe this.

 

[JohnsonDaniel]

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>
<style>
body{
width:1000px;
margin:0 auto;
}
</style>

<body>
<iframe id='bframe'  name='bframe' src='http://www.fatcatrewards.com/uk/bonuscash/?l=50' align="left" style='border: 0pt none ; float:left; width: 500px; height: 649px;' scrolling='no'></iframe>
<iframe id='bframe'  name='bframe' src='http://www.fatcatrewards.com/uk/bonuscash/?l=50' align="left" style='border: 0pt none ; float:left; width: 500px; height: 649px;' scrolling='no'></iframe>


</body>
</html

so if my iframe has absolute positions ie the above, how do I go about putting it to the right or the middle of the page ?

I used Ghostcpa to iframe this.

The only thing really covered in this thread is the use of the referer spoofing script to spoof referers.

For that, you'd have to replace this in your code:

http://www.fat***rewards.com/uk/bonuscash/?l=nn

with this:

http://yourhandlerdomain.com/?url=http://www.fat***rewards.com/uk/bonuscash/?l=nn&referer=http://SitewhereYouPlaced2ndPartofCode

As for the iframe positioning, it was my understanding that GhostCPA would take care of that for you, and would match X and Y coordinates. BUT, I don't use GhostCPA, so I don't know for sure...

 

[cynic]

Sweet now all I need to do is learn how/where to put the code in the WP footer.

 

[jsurya]

I really appreciate OP by providing this useful script.

I am already using CPA Redirector 4 and its wonderful, comparing with this script, still I believe CPA 4 is the best, because, I tested this script, it works great in IE, Firefox, but if you check with Chrome ver.12 it shows "?" in the end of the URL.

in Chrome ver. 12 it shows (in the stats, I checked) it shows

http://www.something.com/post-page/?

in other browsers, it shows,

http://www.something.com/post-page/

Whereas, in CPA 4 it works perfectly as like in other browsers, I accept it won't be a big issue as this script designed for content locker sites, but I am using it for adsense pages.

If people are trying to use this script for adsense sites better double check before implementing this script, as you're using redirection script somehow, G will check that..

One thing I like this script than CPA 4 is, you can set the URLs pretty fast without much work, as in CPA 4, have to setup things for each URLs!

 

[JohnsonDaniel]

I really appreciate OP by providing this useful script.

I am already using CPA Redirector 4 and its wonderful, comparing with this script, still I believe CPA 4 is the best, because, I tested this script, it works great in IE, Firefox, but if you check with Chrome ver.12 it shows "?" in the end of the URL.

in Chrome ver. 12 it shows (in the stats, I checked) it shows

http://www.something.com/post-page/?

in other browsers, it shows,

http://www.something.com/post-page/

Whereas, in CPA 4 it works perfectly as like in other browsers, I accept it won't be a big issue as this script designed for content locker sites, but I am using it for adsense pages.

If people are trying to use this script for adsense sites better double check before implementing this script, as you're using redirection script somehow, G will check that..

One thing I like this script than CPA 4 is, you can set the URLs pretty fast without much work, as in CPA 4, have to setup things for each URLs!

When testing, which code did you use on the spoofing sites? The code from my OP, or the updated code I posted a few posts further down?

That would make a big difference.

Also, what do you mean by "in Chrome ver .12 it shows..."?
Do you mean that is the referer which shows if your surfers used the Chrome ver .12 browser?
Or that's what you see in the address bar when browsing yourself using Chrome.
There "shouldn't" be any difference in what gets displayed in referer stats regardless of the browsers used by surfers, so I'd like some further info on that if you get a chance.

Thanks!

 

[JohnsonDaniel]

Sweet now all I need to do is learn how/where to put the code in the WP footer.

It's untested in the footer, it's really designed to be placed in the header.
However, it doesn't get called when someone just "visits" your spoofed site or posts, so nothing is shown if people try to view the source code.

If you DO test placing it in the footer, do come back and let us know the results, but, for full safety, I'd strongly recommend placing it in your header.php file.

 

[jsurya]

I tested the latest code of yours down the page, it works perfectly on other browsers, but in chrome, it works the same way, but after implementing the fake referer url, the result page ends with "?" (I checked with statcounter.com) when using the script, I request you to kindly check with chrome browser

http://something.com/?url=someurls.com&referer=fakeurls.com

All your codes are perfect, no problem with them. The only issue is the "?" mark while accessing using the chrome browser.

Cheers

When testing, which code did you use on the spoofing sites? The code from my OP, or the updated code I posted a few posts further down?

That would make a big difference.

Also, what do you mean by "in Chrome ver .12 it shows..."?
Do you mean that is the referer which shows if your surfers used the Chrome ver .12 browser?
Or that's what you see in the address bar when browsing yourself using Chrome.
There "shouldn't" be any difference in what gets displayed in referer stats regardless of the browsers used by surfers, so I'd like some further info on that if you get a chance.

Thanks!