Forum Moderators: phranque
This is strange and I cant seem to figure out how Im getting all these hits from this site. In my access logs I get lots of:
00.00.00.00 - - [02/Jun/2009:09:31:35 +0100] "GET /widgets/1834.htm HTTP/1.1" 200 48886 "http://www.web-site-in-question.com/widget1/name-of-page.html" "Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1)"
Obviously not the real IP. I cant work it out, there are lots of hits from various pages. Any ideas?
This is log spamming.
Some Web sites publish their referrer log files or 'stats' as HTML pages, viewable to all on the Web -- I guess as some sort of 'brag' or perhaps just through technical incompetence.So, log spammers have taken advantage of that to put their URLs into those log files in order to build links.
It's a great waste of server and internet bandwidth, energy, and effort, as most major search engines wised up to this 'trick' long ago.
However, I advise that you do not visit those sites unless you have top-notch anti-malware and firewall protection and run your browser with JavaScript, ActiveX, and Java disabled in a non-privileged account; Another reason to drop these links in your logs would be to get you (the Webmaster) to visit their site, so that they can serve you a nice malware download. In fact, this may be how some Webmasters' sites get hacked: Their account credentials might have been stolen by a drive-by-download keylogger.
Instead of visiting the site, just do a DNS lookup on the requesting IP address(es) and do a search on the referring domain name -- That will often tell you enough. Oh, and never use the Google "I'm Feeling Lucky" search feature when doing this, as it will redirect you 'automatically' to the first search result. Be careful out there...
If so this thing has been tearing up the web for a few weeks now spamming log files on a large scale. They use a tool called "PRStorm" and they effectively simulate hits to your site in the hopes you publish your logs so they get a link.
If i was right about the domain, they are doing it simply for Adsense revenue and their content is scraped from Yahoo Answers.
Sad, because with the volume they are doing i'm getting 100's of hits per second and it's dragging my site down and there's nothing i can do.
In http.conf:
RewriteCond %{HTTP_REFERER} example\.com [NC]
RewriteRule (.*) - [F,L]
or
RewriteCond %{HTTP_REFERER} example\.com [NC]
RewriteRule (.*) [127.0.0.1...] [L,R]