www.devco.net by r.i.pienaar

Distributed referer log spamming?

I always look at my web server logs, I find the various log spammers, bots and RSS readers really interesting. About a week ago I noticed a lot of log spamming all in a short period of time and thought something must be going on but waited till it happened again.
Today again I got 5 log spam attempts in a very short interval from different IP addresses. As this is the 2nd time this happens I can only imagine this is 5 machines that is acting in a coordinated fashion.

64.69.172.9 - - [16/Apr/2004:15:29:46 +0100] "GET / HTTP/1.0" 200 32759 "http://www.nudecelebblogs.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
201.128.123.11 - - [16/Apr/2004:15:33:09 +0100] "GET / HTTP/1.0" 200 32759 "http://paris-hilton-video.blogspot.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
212.163.30.100 - - [16/Apr/2004:15:34:15 +0100] "GET / HTTP/1.0" 200 32759 "http://www.shatteredreality.net" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
217.219.165.3 - - [16/Apr/2004:15:34:46 +0100] "GET / HTTP/1.1" 200 32861 "http://britneyspearsnude.blogspot.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
80.58.35.46 - - [16/Apr/2004:15:37:23 +0100] "GET / HTTP/1.0" 200 32759 "http://www.amateurxpass.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"

The IP addresses are in US, MX, ES, IR and ES and interestingly enough have exactly the same user agent. 2 of the machines are running mail servers and may also be NAT/Masquarading machines I am guessing.
Eitherway, I think someone is controlling a bunch of bot machines and using them to spam logs. I wonder if I contact the hosting companies of these sites if they will shut them down?

About R.I. Pienaar

Systems Administrator, Consultant, Linux Guy, Automator, Ruby Coder