Google's own link cloaking

How do they do ti?

[Dude_S]

Using Safari (Mac):

• Go to google.com, search for something.
  
• Hover over any search result, don't click.
  
• Look at the browser status bar on bottom. You see the destination link, right?
  
• Now RIGHT-click (or Ctrl-click with one-button mouse) on the result and select "Copy Link"
  
• Paste the link anywhere.

What do you get? I get a redirect link like this:

hxxp://www.google.com/url?sa=t&source=web&cd=1&sqi=2&ved=0CB8QFjAA&
url=http%3A%2F%2Fwww.example.com%2F&
ei=D4LbTIOqJIzEsAPO3IHmAw&usg=AFQjCNEOLLPRweD4EeKkgig44zS8RMUX8A

Strangely, if you go back to the result page, which should still be open since you didn't left-click, and hover your mouse over the same link again, now you see the real cloaking link in the status bar.

BTW this does not work in Firefox. Copying the link there will get you the true destination link, not a redirect. Which means they apparently sniff user agent and serve different content by browser. Haven't tried other browsers. Would be curious about IE, but don't have Windows.

My question: How does this work?

It is definitely not your old

onmouseover="window.status='http://www.example.com';return true;"
onmouseout="window.status=' ';return true;"

which doesn't really work in any browser I know.

[Dude_S]

BTW, I found Yahoo is doing it too, on both Safari and FF:

http://rds.yahoo.com/_ylt=A0oGdVdBittMJzYAkuBXNyoA;_ylu=
X3oDMTE1cnVjOGcxBHNlYwNzcgRwb3MDMQRjb2xvA3NrMQR2dGlkA1ZJUDAyM18xNjA-/SIG=
11bom492h/EXP=1289542593/**http%3a//www.example.com/

... and so is Ask.com (RIP [webmasterworld.com]):

http://wzus1.ask.com/r?t=p&d=us&s=a&c=a&l=dir&o=0&sv=0a5c404a&ip=4cc3d2f5&id=
62D62CADD5085C2685AA1332502827E1&q=example&p=1&qs=0&ac=112&g=11ebbiCmweVnk5&en=te&io=0&eo=&
b=a001&bc=&br=&tp=d&ec=1&pt=Example%20Web%20Page&ex=tsrc%3Dvnru&url=&u=http://www.example.com/