secret request lusts

 

Googlefd resolves to -- Bing? SHENANIGANS.

UPDATE: a zipped file of the offending page!  available for download here.

WTF is this "googlefd" domain that is suggesting I try some searches instead that are the same exact search that I just did, but on Bing?  Is this a Bing thing? If so, is dirty pool, so I think not.  Inspired by an intrepid Redditor, I took screenshots & decided to trace it -- both with tracert & cURL.

The phenomenon:

When I mouse over it it resolves to a rather shady sounding "googlefd.com."  To quantify how shady, I did some searching — had to use a different browser though, after getting suspiciously sparse results. 

The Whois to the right was certainly shady.  I wish Jsunpack were still around --- maybe there is something else like it?

Apparently not much.  Ipqualityscore.com reaffirmed my suspicions, based on supposed pattern matching to other suspicious websites.

All these are suspicious if you ask me.

Whoxy on googlefd. 

Click to enlarge, 

should open in new tab.

Back from using cURL.  Interestingly, it resolves to Google, not Bing -- or not, since it app

I got a 'That's all we know" Google error.  Sure I did... Wait, no.  That's not what it was doing in the middle -- how'd we get bback to Google?

Besides, the source says it is the "That's all we know " with the picture of the robot -- and there are no images on. the actual error message I got.

As you can see, there were supposed
 to be images on the page below.

So what I did was, I archived it using Archive.is, which gives a running list of all the GETs it has to get and all the POSTs it has to post.  For a while I was saving the list in my clipboard but I lost it.  Nor did I get any screenshots but one at the beginning, when it was still empty.  The screen below swelled to five pages or so.

I did, however, save the HTML of that page about eight times.  So I could have a look.  And Archive.IS is nice enough to both render the page and provide a screenshot.  So we can see that Bing logo perfectly rendered on the latter, missing on the former, where the people requesting obviously didn't have permission.  You can go there to look at that.

I will leave you with the image of that loading page, which I reconstructed from my saved html.  Maybe this will help someone who has an idea of what sort of shenanigans to which these guys from the UK are up.

Be seeing you.