Weird redirect/cloaking going on in SERPS

[DiscoStu]

So I was doing a search for a name (a social media guy who screwed his rep a week or two ago) and came across a type of cloaking/redirect I've seen before but don't really understand.

- The SERP points to an article that uses autogenerated spam content with his name as the main keyword (little over 8% density).

- When clicking through, I get redirected about 2/3 of the time to a search on his name on some other site which redirects to a third site.

- Entering the URL directly in the browser instead of clicking through from the SERP (or just refreshing the page) does not trigger the redirect

Here are the parts that confuse me:

- Cloaking checkers do not show the url the SERPS are pointing to to be using any cloaking

- checking backlinks with yahoo for the domain shows up a lot of sketchy pages from legit looking domains (most of them seem to have broken CSS links leaving only bare html)

- but none actually have any links to the spammy domain in their source code

I'm sure this will disappear fairly soon, but I'm really curious how this works. Even if we don't want to use these methods I think it's important to fully understand them...and I don't at all :P

[tedster]

Could it be traffic theft via DNS cache poisoning [webmasterworld.com]?

[DiscoStu]

I would say that, but in this case the indexed page is spammy itself and has a bunch of shady backlinks pointing to it. DNS cache poisoning is usually spammers trying to get traffic from otherwise legit search results right? So either it's a case of a spammer attacking another spammer (i.e. one spammer is redirecting traffic that another spammer is trying to get to his autogenerated spam content) or something else is going on....