Slashdot Mirror
Spam Through HTTP Referrer Logs
Max Romantschuk continues: "It took a moment to realize what was going on, but then it dawned to me, I was being spammed through my referrer logs! A quick google search on the words "referrer spam" confirmed my suspicions, this was indeed a widespread practice, and not new at all. In fact, Wired had an article on the subject dating almost a year back. It turns out the spammers aren't after blog authors, but what they are actually doing is targetting people which publish their referrer logs on their sites automatically. Fortunately, I don't.
I run a very small site, and get about 20 to 50 visits a day, and I don't publish my logs. Not exactly a likely target, am I? Clearly these spammers seem to do this in volume, and the phenomenon is bound to increase as email spamming is becomming increasingly hard. With email spam, IM spam, Windows Messaging spam (NET SEND popups) and HTTP referrer spam, how long will it take until every open technology has to be locked down? I hate to say it, but I doubt Wikis and similar systems will stay open for very long if things keep going in this direction."
fr0st p1st!
Oh yeah, SPAM is bad! Speaking of SPAM, I saw the official SPAM-mobile yesterday on I-95...Not nearly as cool as the Weinermobile!
GTRacer
- huhuhuhuh...he said weiner...
Defending IP by destroying access to it? That makes sense, RIAA/MPAA. Go to the corner until you can play nice!
The idea behind a Wiki is that anyone can maintain it. The more people that maintaining something, (Linux) means all the more people to remove nasties. In this case the nasties just happen to be spam. As long as copies of the Wiki are kept after every N changes all should be good, just in case a spammer deletes everything...
-- botsex is {grep;touch;strip;unzip;head;mount}
Personally I don't like people tracking my referrer links. Mind your own business. If you want to see who is linking you, you can do that with google. I know people disagree, since your website is your business. But I don't like being monitored that closely.
Maybe I'll set my referrer to goats.cx.
BTW, this story has been seen on Slashdot before.
Last time I asked people about this, I was told this was script kiddies
scanning for open proxies and similar things, using some certain scripts/whatever which annoyed the logs with falsifyed referes.
I run a very small site, and get about 20 to 50 visits a day, until I posted a link to it on Slashdot.
I was having the same problem; getting literally thousands of hits to my site from referrers for all kinds of porn and other random domain names. I did a google search and found this site: http://www.spywareinfo.com/articles/referer_spam/. It shows how to use mod_rewrite with apache to block the most frequent domains. I took Mike's blacklist and created this page, which automatically creates the .htaccess file for you. The problem is that they seem to be registering tons of new domain names so it's hard to keep up a decent blacklist.
they are actually doing is targetting people which publish their referrer logs
Hmmm, who reads the logs that aren't published? Geeks with no girlfriends, maybe? Sounds like a good target audience for a porn site to me.
"Hey, why is [insert favorite porn site here] linking to my geek portal/blog? They must be a good site if they link to mine, and I can easily explain my visit to the boss!"
Just leave your damn referrer blank then. I suppress the referrer through Opera everywhere, and only enable it on sites which are foolish enough to believe I want to leech their images, and on those maybe one or two sites where I know they use my referrer info for something useful.
But don't set it to some bogus info, or you're no better than these crimina^H^H^H^H^H^H^H spammers.
I don't think porn sites are strange at all, in fact there are lots of them.... how silly to think of them as strange...
Web sites can be defaced. This is typically thought of as illegal. Does the level of security on that site affect the legality of the defacement? Just because a wiki is more easily editable than an otherwise non-secure site should not automatically allow hijacking of that site for purposes other than those intended by its owner. Would the appearance of 'specific wording' on the site make enforcement of this easier?
I don't publish the logs on my very small, low-traffic site and I get quite a bit of this as well. All of the non-legitimate referrers on my site seem to be weblogs. No porn so far. I just ignore them. Referrer stats are the least useful part of my logs anyway.
Yoda of Borg am I! Assimilated shall you be! Futile resistance is, hmm?
I would like to know who goes around posting links to their resumes as referers to your website?
Is it the people looking for jobs, or is it some resume posting service? I get about a half-dozen of these per month.
Marques Johansson
It's becoming a rather large problem on MovableType blogs. Apparently, the spammed referrers are usually fake blogs, that are front sites to get a porn webcam link high in Google PageRank.
b ehind_blogs.php t _referral_spamming
http://echo.ashpool.org/blog/305/
http://www.idly.org/2003/11/14/porn_sites_hiding_
http://www.jayallen.org/comment_spam/2003/11/aler
I would think that it would easy enough to send a spider to the referrer page and search for the referred page. If you don't find it, delete it from the log. In fact, you wouldn't even need the spider because the link should be the exact page anyway.
This also becomes a means to maintain the blacklists other have mentioned.
Isn't this simple to do?
Thanks for pointing out that this is spam!
I also get these "referers".
The sad thing is, that it is nowadays half-criminal to do a ping/traceroute to a certain host (Considered preparing an attack) but these spammers can generate their high volume(!) traffic, out of every RFC borders, and don't get problems at all.
"A quick google search on the words "referrer spam" confirmed my suspicions, this was indeed a widespread practice, and not new at all. In fact, Wired had an article on the subject dating almost a year back."
Thats not clue enough that maybe your lack of knowing about this isn't newsworthy?
if ( $ENV{HTTP_REFERER} =~ /slashdot\.org/ )
{
mail("me@mycellphone.com", "help!", "I'm meeeelting!");
init_throttle();
pray();
}
Apparently I was linked by a porn site... I also got my first comment spam today, from a Turkmen guy... Deleted it anyway... =)
One of the main reasons why spammers are stuffing their urls into your referrer logs is to boost their page rank in google. To combat that, google has a simple method for page designers to instruct its bots to not follow links from a certain page. Thus taking away the benefit of spamming your referrer log.
How can I prevent Googlebot from following links from a particular page or archiving a copy of a page?
I would suggest adding these if you insist on keeping your referrer log on your web-site.
Throw out the internet and start over.
PS. Does this mean we have to curse Tim B-L in the same breath as Microsoft?
Mencken had it right. So glad that's old news.
http://www.bloogz.com/
shows referrers on their starting page. The only good thing about it is that they have to provide a working URL to get "return on investment".
I found this site in my blog-referrer stats, but I dont know if they crawled me or if my blog-provider sends information about new blogs to them....
I have used Monster.com on several occasions, and even found a contract there a couple of times, and I was even considering advertising on their site. In just the last week or so, however, I have noticed a new trend that is rapidly rendering Monster.com completely worthless. Seems that my current job search agents (for C++/C#/Java programming) are returning dozens of hits -- but almost all for Multi-Loser-Marketing scams (mostly Herbalife, aka Global Online Systems--this is one of several thousand of their replicated websites) and ads for services that purport to teach me how to "work at home" for a membership fee.
I have complained to Monster, and they have replied that yes, this is a violation of thier TOS, and yes, they would remove the ads that I called to their attention. Just for grins, I checked this morning to see just how many such ads there were on Monster, and found over 5,000 of the Herbalife ads, and about 1,000 of the "work at home" membership ads. This appears to be primarily the output of 3 organizations, with Herbalife 'distributors' responsible for the largest portion. If this is the beginning of a trend, then every MLM and suckerbait outfit on earth is going to be putting their crap there by the end of next week, drowning the legitimate job ads in the noise. For example, my last search produced exactly one legitimate job opening in the last 2 days, and 10 listings for a "work at home" service. (How many legitimate businesses actually use the word 'legitimate' in their names, anyway?)
While tracking down the perpetrators of the most egregious ads, I came across this description of just what Herbalife is, and the damage being done to the Sacramento area by Herbalife 'distributors'. Very interesting read. These scumbags are making spammers look good... OTOH, it sure seems to me that Monster needs to clean up its act, too. They obviously can't remove these fraudulent ads as fast as the MLM victims post them, so they need to start preventing them from getting there in the first place.
Concealed Handgun License Courses in Plano, Texas