yeah, the refresh is sending me different place every time.
I had mystery code pop up into a corporate site I developed once
the guy was sneaky, added something like
include(rawurl(%20%02%2......))
to not make it look like a URL, from which he was including a text file.
it's amazing what these leeaches will resort to doing now a days to flag or spam, to what purpose might I ask? I refuse to buy anything spammed to me simply out of spite