Fake real referer url redirection

I need some input/suggestions to see if anyone has tried this or is using this method to make it look as if your refering url is coming from your whitehat site when really its coming from both.

this is just an example, not real sites or anything

Say I have blackhattraffic.com, that is where I get all my blackhat traffic to go to and it meta refreshes to legitsite.com/redirect. In the legitsite.com/redirect directory I have php double check to make sure that no referer was leaked from blackhattraffic.com meta refresh redirect or else nothing happens. If it passes the no referer from blackhattraffic.com then I javascript redirect with window.location.href to the affiliate offer and the refer from legitsite.com/redirect is legitimately sent to the affiliate companies. Then in the legitsite.com home page I make a landing page that is advertising and explaining the product that I chose for the zip/email submit. All links on that whitehat home page go to legitsite.com/redirect so that if the affiliate manager decides to go back a subdirectory of what is being sent as the referer it all leads to legitsite.com which is a normal website.

So what I'm trying to do is make it look as if the traffic is coming from somewhere that is not doing anything blackhat but in reality its coming from both sources. I just checked window.location.href and it sent the refer from the page the code was on in ff3.

Why meta refresh and double check the referer? Using the right javascript on your legitsite.com is enough to guarantee that your legit site alone will appear to be the referer.

Well, I haven't tried redirecting with "window.location.href" to confirm for sure that it gaurantees that your legit site is the referer, but if it seems like it is working then it always will.

Since javascript executes on the client-side, there are various javascript redirection methods indistinguishable from a real click on a link.

BozoClown said:

Why meta refresh and double check the referer? Using the right javascript on your legitsite.com is enough to guarantee that your legit site alone will appear to be the referer.

Click to expand...

Just like the double meta refresh checks to make sure nothing is sent by some faulty browser, this does the same. Every browser acts differently.

Genjutsu said:

Through all my testing, I have found that there is no such thing as always. Different browsers do different things under identical code.

Click to expand...

What browsers have you seen this not work on by sending the referer with js redirection. Would this be the best js redirection method or has there been a better one that runs closer to the same on different browsers?

Anyways, even if all the browsers don't act the same with the js redirect wouldn't the legitsite.com/redirect's php check to make sure traffic with the referer from blackhattraffic.com is not being sent stop the referer from ever being sent to the affiliate all the time?