I have seen php malware distribution code that checks if it's a google originating address and doesn't display to the "user" if it is.