unexpected traffic in server log

March 13, 2005 7:45 PM

I'm seeing wierd things in my server logs.

I manage a website as part of a nonprofit. On our server logs, I've been seeing referrals from advertising management companies like banmanpro.com. We don't have ads anywhere; what's going on? I have seen other people get pop-up ads by going to pages on our site, but I thought that was fixed.

posted by atchafalaya to computers & internet (9 comments total)

Referral spam?
posted by DrJohnEvans at 7:47 PM on March 13, 2005

But doesn't that depend on us linking to them in some way?
posted by atchafalaya at 8:05 PM on March 13, 2005

Go to the url of the site listed as the referrer.

They are linking to you, find out why. It has nothing to do with you linking to them.

It might be as innocent as the other site saying "Here's a great non-profit, go there" (though I doubt it).

Referral spam doesn't make much sense, as only the nonprofit's web manager is going to be seeing the logs.
posted by orthogonality at 8:18 PM on March 13, 2005

The site is a sprawling mess and I can't find anything, but the referral comes from their banmanpro internal page. Is there a way for me to search all the pages on the site? I tried googling their name and our name combined, but nada.
posted by atchafalaya at 8:26 PM on March 13, 2005

When a web browser connects to your web server, it connects to port 80 and sends a request in plain text that looks something like this:

GET [path to file]
Host: [Your domain name]
Referer: [referring URL]
Connection: [connection type]
User-agent: [browser name]

Your server responds with a few similar headers in plain text and then serves up the web page.

Remember that this information is sent in plain text. The information received in the request is not validated in any way. Anyone could write a program in 2 minutes that can send requests to your web server, claiming to be referred by www.metafilter.com and with a user-agent value indicating MS Internet Explorer 5.5

Some people have written scripts that go around making web page requests with bogus referer info, just to get their URL into your logs -- and hopefully into your publicly-available statistics, if any, which would boost their site's position in search engines. Or maybe they're just trying to draw the attention of web site owners who are checking their own statistics.
posted by winston at 8:31 PM on March 13, 2005

What winston said. They are almost certainly not actually linking to you.
posted by monju_bosatsu at 8:32 PM on March 13, 2005

Wow. The futility. Thanks everybody!
posted by atchafalaya at 8:40 PM on March 13, 2005

But doesn't that depend on us linking to them in some way?


Not at all. These people are simply faking referrer headers in the hope that you have your referring pages listed somewhere on the site (as some blogs do) and they'll get some PageRank juice out of it from Google. I get it on my sites as well and I don't have referrers listed anywhere in public. But the spammers don't care; they just hit as many sites as they can.

And I wouldn't go looking for links to your site on something like www.credit-card-deals.info or similar sites. They're not there. They're faking the header, remember. :)
posted by madman at 8:46 PM on March 13, 2005

Google referrer spam and you'll find what you need to know to combat it. My site's somewhere in the first page of results with a list of resources but I'm a bit too lazy to dig up the permalink right now.
posted by brownpau at 9:00 PM on March 13, 2005