Latest referer scourge?

April 16, 2006 3:53 PM

Any idea what the latest internet referer scourge might be?

I'm seeing a lot of strange accesses on my server. They come from a lot of IPs (presumably zombies or open proxies) and don't send any referer. And they always truncate the URL of the page on my server to 47 characters, obviously resulting in them being routed to my 404 page, since nearly all the URLs on my site are longer than that.

For instance:

- -> http://denbeste.nu/cd_log_entries/2002/08/TheBu 129.2.29.60 0pct.
- -> http://denbeste.nu/cd_log_entries/2003/06/Sexua 70.239.8.170 0pct.
- -> http://www.denbeste.nu/cd_log_entries/2002/08/A 24.218.17.133 0pct.
- -> http://denbeste.nu/cd_log_entries/2004/07/Terro 68.219.213.82 0pct.
- -> http://www.denbeste.nu/cd_log_entries/2002/12/N 67.81.107.151 0pct.
- -> http://denbeste.nu/cd_log_entries/2002/04/Samur 68.169.215.166 0pct.
- -> http://denbeste.nu/cd_log_entries/2003/01/Suppo 68.41.166.152 0pct.
- -> http://denbeste.nu/cd_log_entries/2002/02/fog00 24.53.132.39 0pct.
- -> http://denbeste.nu/cd_log_entries/2003/10/Rapea 192.152.243.26 0pct.
- -> http://denbeste.nu/cd_log_entries/2003/10/Rapea 192.152.243.26 0pct.
- -> http://denbeste.nu/cd_log_entries/2004/01/Upaga 24.126.145.183 0pct.

What is this, and what are they hoping to accomplish?

posted by Steven C. Den Beste to computers & internet (3 comments total)

it could be "referer spam", people do it through bots that visit your site in hopes that who ever reads the log site may visit their listed site.
posted by College Student at 4:21 PM on April 16, 2006

The only problem with that idea is that they're not sending any referers.
posted by Steven C. Den Beste at 4:42 PM on April 16, 2006

I've been getting these occasionally as well; a bot spoofing "google.com" or having no referrers in their headers as their referrer and going to incomplete URLs, often coming from lw-box30.moderndedicate.com. Seemed suspicious, so I've blocked it.
posted by brownpau at 5:43 PM on April 16, 2006