I run a community airport website named OurAirports, so it’s not unusual for me to get e-mail from smaller airports and flying clubs with updates, but big airports have never bothered with me.

As one would expect, O’Hare Airport’s existing web site makes no mention of a new, updated site. In this scam the scammer is not phishing for personal information or trying to scam money, but instead, is trying to get pagerank over the official O’Hare site by tricking thousands of sites into providing links.

What are they looking for? Given that the e-mail traces back to a site called huntparking.com, I’ll guess that they want to use the web traffic either to sell ads for airport parking or to sell their own parking.

The e-mail and whois info are below. Nicely done, by the way — the fake site is much better designed than O’Hare’s real site, and even the markup snippet in the e-mail is XHTML-compatible. Perhaps O’Hare Airport should consider hiring the designer instead of bringing charges.

The message

Message-ID: 
From: "Chicago O'Hare Airport"
To: [removed]
Subject: New Chicago O'Hare International Airport website
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Windows Mail 6.0.6001.18000
X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6001.18049
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - host.huntparking.com
X-AntiAbuse: Original Domain - ourairports.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - ohare-airport.org

To whom it may concern:

We are proud to announce the launch of the new Chicago O'Hare =
International Airport website www.ohare-airport.org. It provides =
comprehensive real time flight information on arrivals, departures and =
delays, terminals and maps, parking, transportation, directions, food =
and shopping, hotels, etc.

If you find our website to be of value to you and your readers, we would =
appreciate it if you could add a link to us at your URL =
http://www.ourairports.com/airports/KORD/ where, in our opinion, it =
would be the most relevant.=20

Alternatively, you can utilize the customized link code provided below =
(just cut and paste):


Chicago O'Hare =
airport
If you have any questions, please, do not hesitate to contact us. Thank =
you for your time and consideration.

Kind regards,

Natalia Klimovich
Website Administrator
www.ohare-airport.org

Whois Information for ohare-airport.org

Domain ID:D155295366-LROR
Domain Name:OHARE-AIRPORT.ORG
Created On:07-Feb-2009 08:45:01 UTC
Last Updated On:09-Apr-2009 03:54:26 UTC
Expiration Date:07-Feb-2010 08:45:01 UTC
Sponsoring Registrar:GoDaddy.com, Inc. (R91-LROR)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Registrant ID:GODA-059235088
Registrant Name:Alexei Pavlovitch
Registrant Street1:240 E Illinois
Registrant Street2:apt 1202
Registrant Street3:
Registrant City:Chicago
Registrant State/Province:Illinois
Registrant Postal Code:60611
Registrant Country:US
Registrant Phone:+1.3125936015
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:alex.pavlovitch@gmail.com
Admin ID:GODA-259235088
Admin Name:Alexei Pavlovitch
Admin Street1:240 E Illinois
Admin Street2:apt 1202
Admin Street3:
Admin City:Chicago
Admin State/Province:Illinois
Admin Postal Code:60611
Admin Country:US
Admin Phone:+1.3125936015
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:alex.pavlovitch@gmail.com
Tech ID:GODA-159235088
Tech Name:Alexei Pavlovitch
Tech Street1:240 E Illinois
Tech Street2:apt 1202
Tech Street3:
Tech City:Chicago
Tech State/Province:Illinois
Tech Postal Code:60611
Tech Country:US
Tech Phone:+1.3125936015
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:alex.pavlovitch@gmail.com
Name Server:NS07.DOMAINCONTROL.COM
Name Server:NS08.DOMAINCONTROL.COM
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:

See the update below. I was right: Google’s new bot detection is overly naive, and I’m not the only one having problems.

See also John Cowan’s comment below, for a different (personal) interpretation of Google’s terms of service.

Google Maps won’t show me satellite imagery this morning.

Google has recently set up a system to try to autodetect and block bots scraping their system, and it isn’t working very well — people are getting blocked even from Google Search simply because they have too many (human-generated) queries passing through the same proxy.

This morning, I suddenly discovered a different problem: the satellite view in Google Maps has stopped working for me — I get the “don’t have imagery at this zoom level for this region” error everywhere, at every zoom level. I can still see maps and terrain, but not satellite pics, and I noticed the host sorry.google.com setting a lot of cookies.

Is Google’s satellite imagery down for everyone else this morning, or has their software decided that I’m a bot trying to scrape satellite imagery?

Update

I was right — Google’s software had decided that I was a bot. They have a test link directly to a satellite to see if you’re being blocked:

http://khm0.google.com/kh?v=31&hl=en&x=0&y=0&z=1&s=

It took me to this page. I was able to renable access simply by entering a CAPTCHA.

What happened?

I wrote a couple of months ago about how to detect overzoom in Google Maps. My guess is that the overzoom protection in OurAirports — automatically zooming out every 4 seconds until there were actual satellite tiles available — triggered to bot alert, and I’ve disabled the feature for now.

That’s very bad news for any mashup that uses JavaScript to do more sophisticated things with Google Maps, like, say, panning at regular intervals. Google’s bot detection seems to be extremely naive, and any repeated action at regular intervals will fire it off.

http://www.feliciano.de/Webgalerie/bilder/Italy/une/yiwul/
http://www.unduetretoccaate.it/codice/aseje/wocobo/
http://www.altaiseer-eg.com/ar/articles/jed/umut/

At first, I thought they might be a kind of link spam — some sites display recent searches — but when I checked one of the URLs, I found something totally unexpected:

php echo md5("just_a_test");?>

They’re all the same. This is almost certainly related to passwords: is there a known flaw in a PHP content-management system like Drupal, or in the PHP API for a search engine like Lucene, where this would do some damage, or is it just a test probing for weaknesses? Is the PHP code supposed to be served up literally like that, or should I be seeing the MD5 instead?