Comment by blhack | Hacker News Reader

Comment by blhack | Hacker News Reader

Oh, malarky.

Here. I set up a page at http://lab2.gibsonandlily.com/google.html

Then I ran it through google translation services. Here is the result in apache's log:

74.125.16.18 - - [13/Jan/2012:10:45:37 -0600] "GET /google.html HTTP/1.1" 200 327 "http://translate.google.com/translate_p?hl=en&sl=fr&... "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.75 Safari/535.7,gzip(gfe)

Look familiar? This one is tossing up windows NT, which is strange, but it doesn't seem like a stretch that some of the machines at google for stuff like this are running linux.

The scam here isn't being done by google, it's just a run-of-the-mill scammer scamming and using google's name.

Dearest mocotality. Turning on referals in apache logs and you'll see where on google this is coming from (if you care to).

Here is how:

in: /etc/apache2/apache2.conf (or whereever your apache configuration sits) change the "Logformat" option to the following:

LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined

and then use option:

CustomLog /var/log/apache2/access_log combined

(or whatever log path you want).

> it's just a run-of-the-mill scammer scamming and using google's name

A scammer selling a Google service for which their is no affiliate program?

I wouldn't file this one away due to having a Google crawler on an IP address that’s on the same B block (that's like having the same car brand, not the same make/model)... An IP address that's not even related to the original investigation, but to some anecdote at the very end of the story.

We need more info about the service being sold, and how it's being sold, who's the billing party, etc.

The scammer invented their own referral program by charging the businesses for a website.

The only real tie to google here is that some person on a telephone used google's name.

From the PDF transcript, page nine:

Caller: No, it’s absolutely free, free of charge. Ok, there’s a small fee for hosting of Ksh. 200 per month.

This seems like an incredibly simple scam, and it looks like blhack's nailed it.

There is nothing connecting this to Google apart from that one IP address. I could phone up half a dozen companies and claim to be from Google, too. Hell, I get phone calls from "Windows Security Centre" every few weeks telling me to do something to my non-existant XP install.

> Look familiar? This one is tossing up windows NT, which is strange, but it doesn't seem like a stretch that some of the machines at google for stuff like this are running linux.

This is actually your user agent, isn't it? Google is probably forwarding your user agent string, so that you get a page that is optimized for your browser.

That's an excellent point, and actually complete's the loop on the story.

The machines that this scammer is using run linux, which explains why the user agent reported this both when they were reading the pages directly, and when the started using google translate.

Neat. I hope they follow up by taking my advice and including the referal so we get to see exactly where it's coming from.

For me it did forward my user agent.

Not sure if I'd jump straight to malarky, but I definitely think it is very plausible that a scamming outfit is running the pages through translate, either as an obfuscation or actual translation.

That sounds very plausible.

Reply on news.ycombinator.com