Check the User-Agent that correspond to these requests - is it an old browser?
Google uses a
meta tag in the
head section of the SERPs of the form:
<meta content="origin" name="referrer">
So, regardless of whether the target site in the SERPs is HTTPS or HTTP, only the
https://www.google.de/ part (ie. scheme + hostname) of the HTTP Referer is sent by the browser.
But, what if the browser doesn't support this meta tag?
I guess the
Referer header could also be "fake", or the user has some kind of browser plugin that "interferes" with it (or even removed the
I thought that in HTTPS mode, Google would not send keywords in the referer anymore.
Google only uses HTTPS these days.
Without the meta tag described above (or some other intervention) then the full Referer would be passed (query string and all) when navigating to another HTTPS site.
However, if your site was HTTP then ordinarily the browser wouldn't send the
Referer header at all (when navigating from HTTPS to HTTP) if it wasn't for the meta tag.