Injection attempt or Advertising technique?

Mathew Sealy <[email protected]>
Newsgroups gmane.comp.security.websecurity,gmane.comp.security.penetration,gmane.comp.security.web-applications
Message-ID <95DE03CCC08D4F42ACF9F3DE669C5A0DCF643402@vmenterprise10.shj.co.uk>
Hi

We have recently seen some odd references on Google analytics for our domain, I haven't actually traced yet whether there were any GET requests for this link, but Google webmaster tools are suggesting that a URL used to access our domain was

www.domainname.co.uk/?ref=%C4%B0lkSexShop.Com<http://www.shj.co.uk/?ref=%C4%B0lkSexShop.Com>

I was wondering what the objective is of this type of ref, if you search on /?ref=%C4%B0lkSexShop.Com<http://www.shj.co.uk/?ref=%C4%B0lkSexShop.Com> in Google you will see this reference for different domains.

Is this an Injection attempt or some sort of Google Bot disinformation technique to advertise sexshop.com?

Thanks

Mat Sealy MCSE, MCTS, SEC+
Network & Systems Administrator
SHJ Hospital Pipelines Ltd

Unit 4 Anglo Business Park
Asheridge Road
Chesham
Buckinghamshire
HP5 2QA
01494 782168

[Description: logo]
P Before you print think about the ENVIRONMENT


-------------------------------------------------------- The content of this e-mail (including any attachments) is strictly confidential and may be commercially sensitive. If you are not, or believe you may not be, the intended recipient, please advise the sender immediately by return e-mail, delete this e-mail and destroy any copies. --------------------------------------------------------
image001.png (image/png, 5.3 KB) - not displayed
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.