Referer log spammers

18 Nov 2003

I have been noticing in my referer log a couple of hits that looks to me like hits simply to spam my logs.

217.73.164.106 - - [13/Oct/2003:17:49:35 +0100] "GET / HTTP/1.0" 200 21978 "http://www.kwmap.com/" "MSIE 6.0"
217.73.164.106 - - [13/Oct/2003:17:49:35 +0100] "GET / HTTP/1.0" 200 21978 "http://www.kwmap.com/" "MSIE 6.0"
217.73.164.106 - - [14/Oct/2003:10:12:31 +0100] "GET / HTTP/1.0" 200 21978 "http://www.kwmap.com/" "MSIE 6.0"
217.73.164.106 - - [14/Oct/2003:10:12:31 +0100] "GET / HTTP/1.0" 200 21978 "http://www.kwmap.com/" "MSIE 6.0"
217.73.164.106 - - [04/Nov/2003:08:13:52 +0000] "GET / HTTP/1.0" 200 26409 "http://www.websearchde.com/" "MSIE 6.0"
217.73.164.106 - - [12/Nov/2003:22:42:50 +0000] "GET / HTTP/1.0" 200 27410 "http://www.wr18.com/" "MSIE 6.0"
217.73.164.106 - - [15/Nov/2003:10:41:49 +0000] "GET / HTTP/1.0" 200 27053 "http://www.malixya.com/" "MSIE 6.0"
141.85.3.130 - - [16/Nov/2003:21:34:49 +0000] "GET / HTTP/1.0" 200 27053 "http://www.worldnewslog.com/" "MSIE 6.0"
141.85.3.130 - - [17/Nov/2003:03:23:07 +0000] "GET / HTTP/1.0" 200 27053 "http://www.mikesspot.com/" "MSIE 6.0"
141.85.3.130 - - [17/Nov/2003:10:15:22 +0000] "GET / HTTP/1.0" 200 27053 "http://www.a-b-l-o-g.com/" "MSIE 6.0"
141.85.3.130 - - [17/Nov/2003:17:12:02 +0000] "GET / HTTP/1.0" 200 27360 "http://www.teoras.com/" "MSIE 6.0"
217.73.164.106 - - [18/Nov/2003:04:10:25 +0000] "GET / HTTP/1.0" 200 27323 "http://www.websearchus.com/" "MSIE 6.0"
217.73.164.106 - - [18/Nov/2003:22:25:51 +0000] "GET / HTTP/1.0" 200 27323 "http://www.saulem.com/" "MSIE 6.0"

The thing that makes me think they are spam bots is that all they ever do is ask for the main page, none of my images, CSS or anything like that - and the obvious fake user agent.

I looked a bit at the IP addresses in various databases and they are from Romanian educational networks and all the sites being advertised are from Romania.

So I think it is time I add user_agent = "MSIE 6.0" to my deny lists.

Posted by R.I.Pienaar on Tuesday, November 18, 2003 at 11:15 PM

Filed in

Leave a comment

Recent Entries

  • flashpolicyd 2.0

    I wrote a multi threaded server for Adobe Flash Policy requests, some background from Adobe:Since policy files were first introduced, Flash Player has recognized /crossdomain.xml...

  • Adventures with Ruby

    Some more about my continuing experiences with ruby, in my last post I saidthe language does what you'd expect and as you'll see in my...

  • New programming language of choice - Ruby

    I have fallen out of love with Perl some time ago, I cannot point to one specific thing about it that put me off, I...

  • On working from home

    I've not been posting much here, work has been incredibly manic the last while, especially I need to still finish off my SSO posts with...

  • Rework of puppet facts for /etc/facts.txt

    Previously I blogged a custom fact that reads /etc/facts.txt to build up some custom facts for use in Puppet manifests, well I've since learned a...

Close