Categories

« Hallowe'en 2004 | Main | I am chagrined »

Link Refererer spamming

Referer link spamming is when someone from Site A fakes out web servers on Site B into thinking someone was referred from Site A. The hope is that Site B is running one of those dynamic visitors lists and, by doing so, Site A appears on Site B's list when Google's indexing spider visits. Google "sees" another occurrence of Site A and ranks them as more important than other, comparable sites. The industry name for this practice is "search engine optimization." I've seen an uptick in the number of link spammers "visiting" my site. Initially, these were one-offs like the P.Hilton video hawkers who had set up on blogspot.com. Last month, there was a spike from a Hallowe'en costume vendor who did the same. I've also been seeing direct hits from , makers of software to automate link spamming. Here is a specific example of referrer spam, rendered in bitmap form because these people annoy me and I don't want to encourage any business their way. I don't use the dynamic "visitor lists" for this very reason, but the link spamming still annoys me when I check my site stats and find that a new visitor is indeed a spammer. Luckily, my site uses apache, and this is moderately easy to fix by modifying the rules Apache uses. For example, to block the above referers, I can create some general rules:
RewriteEngine On RewriteCond %{HTTP_REFERER} ^http://paris-hilton-videoblogspotcom*$ [NC,OR] RewriteCond %{HTTP_REFERER} ^http://(www\)?*debt*info*$ [NC,OR] RewriteCond %{HTTP_REFERER} ^http://(www\)?*mortgage*info*$ [NC,OR] RewriteCond %{HTTP_REFERER} ^http://(www\)?*loan*info*$ [NC,OR] RewriteCond %{HTTP_REFERER} ^http://(www\)?*french-wine-cellar*info*$ [NC,OR] RewriteCond %{HTTP_REFERER} ^http://(www\)?*credit*info*$ [NC,OR] RewriteCond %{HTTP_REFERER} ^http://halloween-costumes-onlineblogspotcom*$ [NC,OR] RewriteCond %{HTTP_REFERER} ^http://wwwadminshopcom*$ [NC,OR]
I'd be interested in other experiences with getting rid of these bozos. One curious thing in my logs was some of the sites only request the page and not the content within. There should be a way to write an automated rule.
4 Comments:
Debbie wrote on (November 2, 2004 4:41 PM)

I keep getting spam from a video poker site - 80 or more "posts" a day since I switched to Wordpress. They've been moderated, so they will never get to see their spam on my website, but it's still aggravating. It makes me wonder who they are trying to appeal to, since they've probably angered the whole blogosphere with their stupid little ads.

jim wrote on (November 15, 2004 7:20 AM)

Wow, these guys can create domains faster than I can add them.
I just blocked anything referred from domains ending in .info and .biz.

While examining the logs further, I see where they were also using spam-bots to post comments to movable type. Thus, if you're a movable type owner, you ought to edit mt.cfg and then rename the scripts.

jim wrote on (November 25, 2004 11:23 AM)

Added two more to the mix. These phentermine guys are total assholes in the link spamming department with 60 hits in the last few days.

RewriteCond %{HTTP_REFERER} ^http://(www\.)?.*deals.*\..*$ [NC,OR]
RewriteCond %{HTTP_REFERER} ^http://(www\.)?.*phentermine.*\..*$ [NC,OR]

Christian wrote on (March 31, 2005 2:03 PM)

You can rewrite this

RewriteCond %{HTTP_REFERER} ^http://(www\)?*credit*info*$ [NC,OR]
RewriteCond %{HTTP_REFERER} ^http://(www\)?*debt*info*$ [NC,OR]
RewriteCond %{HTTP_REFERER} ^http://(www\)?*mortgage*info*$ [NC,OR]
RewriteCond %{HTTP_REFERER} ^http://(www\)?*loan*info*$ [NC,OR]

into

RewriteCond %{HTTP_REFERER} ^http://(www\)?*(credit|debt|mortgage|loan)*info*$ [NC,OR]

Better yet, use an external textfile for this so you can edit it independently of the configuration.

Seattle Area Weather

Mostly Cloudy: 57° F, wind 200°@ 9 mph, visibility 10 mi, 71% humidity

Recent Comments

jim on Hello Kitty bag: My wardrobe is specially designed to emit a stealth field le

susan dennis on Hello Kitty bag: PLEASE tell me you have a matching outfit. Or at least a sn

jim on 22 seconds longer: John: I might be up for a New Year's Eve ride, ideally short

Stacy on 22 seconds longer: I'd like my mocha back, please. hee. Congratulations, Jim.

John on 22 seconds longer: Gee, I was hopin' you would need to join me for the new year

Tag cloud

December 2007

Sun Mon Tue Wed Thu Fri Sat
            1
2 3 4 5 6 7 8
9 10 11 12 13 14 15
16 17 18 19 20 21 22
23 24 25 26 27 28 29
30 31          
[ the archives (1.0) ]
Creative Commons License
This weblog is licensed under a Creative Commons License.

Technorati

Technorati search

» Blogs that link here


Got a comment? Is something broken? Email me at .
I appreciate and read every email, but I'm so deluged, that I can no longer respond personally. Please don't be offended.


deformity-laggardly