Referrer spam

I had turned off my webalizer stats on this site a long time ago because of the number of spam referrers I was getting, in hopes that they would go away if there were no actual on-line links that they could get a benefit from by spamming my referrer logs, and after that I pretty much haven’t paid any attention to my log files for months.

Well, yesterday I saw a reference to a freeware program called Weblog Expert Lite. Having had a rather serious issue with the Bravenet counter I was using I decided to give it a try and see how it worked. (Not only was the advertising on Bravenet’s site reaching the point of ridiculously intrusive, I actually got prompted to download an install.exe program that AVG identified as a trojan from one of the crappy ads on their site and that was pretty much the end of that.)

Anyway, I went and grabbed the last week’s worth of logs and ran them through the program. I was shocked to discover that the top 25 referrer sites were all spam. In fact, there were over 10,000 404 errors in one week, compared to just over 1000 page loads of the front page of this blog.

So I dug a little deeper, and discovered that, apparently, there is an army of zombie machines at dozens, if not hundreds, of different IP addresses, requesting the archive of this blog from Feb. 10, 2002 with an incorrect file extension. (.htm rather that the correct .html)

So if my math is correct, for every one legitimate request to view the main blog page, there are 10 spam/error requests. On a much bigger site, that sort of math could also be called a dDos, couldn’t it?

Anyway, I realize now that even though I disabled webalizer, I had left the webalizer folder and the old files up on the site. I just deleted that directory so we’ll see if the spammers learn and move on or not.

Oh, by the way, I switched over to StatCounter, a much nicer and less obnoxious counter service.

Tags: ReferrerSpam

Similar Posts

  • Lunchtime shopping

    Remember when I said I was going to take that $40 I earned doing a little side tech support and use it to repay some of the places that have helped me be better at my job. Well, I wound up making a $20 donation to Spywareinfo.com, and purchasing two paid subscriptions to newsletters that…

  • More snow

    Woke up to more snow today, and yet another slippery drive into downtown. I did make it safely though! Even got here early. 🙂 Now pardon me while I get off to Monday morning staff meeting and then I’ll be in the wiring closet looking at that switch problem. Maybe that won’t be so bad…

  • Last day

    Yup, today’s the last day of work. I start my new job on Monday morning. I’m currently working in an office with all my belongings packed up, with bare walls and bare desk space. The whole “moving out” look, definitely. There’s nothing like the feeling of killing off your own voice mailbox, your own email…

  • Seemingly random AV thought

    Oh, want to know what I learned today? When you remotely install Symantec’s Corporate edition AV product, make sure the user either has Outlook closed when you do it, or restarts Outlook immediately after you do it. The Outlook add-in does some things that make certain features of Outlook go pretty bonkers. Nothing a quick…

  • Docly

    I got an email earlier this week about an interesting new service put together by the people who gave us Numly, the service that lets you copyright your blog posts or other on-line content. (And yes, I’ve gotten away from doing that, mostly out of sheer laziness.) It’s a service they’re calling Docly: Docly, the…

  • It makes my head spin..

    Yesterday I spent probably two hours discussing a change that we’re doing at work. In layman’s terms, one of our employees is moving into a newly created position with another entity that is a “partner” of ours. He’ll work for them, but still be our employee, work out of our offices and have an email…

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Your post must include a link to this post.

How does this work?
Write a response on your own website and include a link to this post. Then submit your response’s URL here. Your response may appear here after moderation. To update or remove it, edit or delete your original post and submit the same URL again. Learn more about Webmentions.