|
This is actually a (slightly updated) repost of some observations I originally posted on the geeklog-spam mailing list:
This somewhat baffled me. I came across quite a few entries in the geeklog.net logfiles that seemed to indicate that someone was referrer spamming for Geeklog sites: 64.71.131.111 - - [19/May/2005:03:00:04 -0400] "GET / HTTP/1.1" 200 48556 "http://www.vivelecanada.ca/staticpages/index.php/ribbon" "Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.6) Gecko/20040206 Firefox/0.8"
64.71.131.111 - - [19/May/2005:07:39:54 -0400] "GET / HTTP/1.1" 200 48342 "http://www.datingsitesreviews.com/staticpages/index.php?page=0LinkPartnersExchangeInfo" "Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.6) Gecko/20040206 Firefox/0.8"
No other requests from that IP, i.e. no attempts to load the images or the stylesheet. Usually, that's a strong indicator for referrer spam (unless it's a text-based browser, like Lynx).
Poking around in the logiles brought up more such requests, from similar IP addresses and with the same user agent (Firefox 0.8 is unusual enough these days). Eventually, I came across this:
64.71.131.113 - - [19/May/2005:00:13:59 -0400] "GET / HTTP/1.1" 403 26 "http://www.ecomwebd.net/geeklog/" "OmniExplorer_Bot/1.07 (+http://www.omni-explorer.com) Internet Categorizer"
Similar IP address, again coming from a Geeklog site. But look at the user agent ...
As you can see from the response code (403, i.e. Access Denied), I've already blocked this bot. It caused a few 404s and a bit of load occasionally. It also doesn't exactly tell you a lot about itself when
you visit http://www.omni-explorer.com (which is an empty page, stating "comming soon" - yes, "comming" - very professional-looking ...), so I figured it wouldn't be a loss.
Looks like they're visiting the pages with a different user agent string on occasion (Googlebot is supposedly doing the same, btw).
Initially, I've decided against blocking the IP range the bot comes from, but when it wouldn't stop I changed my mind and did just that. In the meantime, other sites report seeing the same thing.
Btw, this is the only bot I've seen so far that actually sends referrers. Googlebot and friends don't do that, hence my confusion.
|