[ILUG] Google weirdness -- gamed or hacked?

[Francis Daly]

2008/9/22 Brendan Halpin <brendan.halpin at ul.ie>:
> I have had a result from google that returned a bunch of weird
> links. They all lead to what appear to be fake search engines, and do
> not correspond to the URL displayed.
>
> Some of the destinations have apparently invalid hostnames (e.g.
> find.tj) but resolve locally to 88.151.113.*
>
> Moreover, the search had "site:ul.ie" as a qualifier, so the reported
> URLs are all within UL but are non-existent.
>> I presume something is broken -- is it my Firefox/IceWeasel, local DNS,
> Google?

I suspect it's UL.

At least, when I do the same google search, I get similar results.

Make the GET request using curl, and I get back a 404.

Make the GET request using iceweasel, and I get back a 301 redirect to
a find.uz or find.tl site.

I can see my initial GET request is going to a UL ip address, and I
can see the HTTP headers.

Suggest you invite the administrators of 193.1.101.61
(www.student.ul.ie, among other things) to examine closely their web
server.

Particularly if someone makes the following http request:

curl -i -H 'User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US;
rv:1.8.1.3) Gecko/20070310 Iceweasel/2.0.0.3 (Debian-2.0.0.3-1)' -H
'Referer: http://www.google.com/search?hl=en&client=iceweasel-a&rls=org.debian:en-US:unofficial&q=hpsim+site:ul.ie&start=20&sa=N'
'http://www.student.ul.ie/9738517/donwload_free_trillian.phtml'

Without User-Agent and Referer, I get back a 404. With both, I get a 302.

f