i write a script for checking referer. and see this url in it xxxx://xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
how it possible

HTTP_REFERRERs can be easily forged

i know
how it's possible
i think that he do with fsockopen
but how