HTTP GET requests from blacklisted referers are modified to requests with the filename 'phishing' and the file extension of the original request - this means requests via blacklisted referers go through a normal request pipeline (through any other reverse proxies, etc.), and that different types of replacement resources can be served up for different requested file extensions (including HTML files [e.g. for phishing sites that redirect to yours after stealing credentials], CSS files [e.g. change the styles of a phishing site that hotlinks stylesheets], image files [e.g. replace hotlinked images with warning images], etc.).
0 commit comments