Referrer Spam - Why you shouldn't publish your Web logs

[Alan Perkins]

While making this post I had cause to look around the Web for a site that published its stats using Webalizer 2.01. I found a few pages and used this one as an example:

http://thinkcycle.media.mit.edu/webalizer/usage_200211.html

Looking through these stats reminded me of why you should not publish your Web stats online. Namely, referrer spam.

Take a look at the top search queries (http://thinkcycle.media.mit.edu/webalizer/usage_200211.html#TOPSEARCH) and in those stats and you'll see searches for these two phrases:

usage statistics for
allintitle: usage statistics

This could well be spammers looking for people who publicly publish their Web stats.

Why would spammers do this? Because it's then possible for them to send hundreds or thousands of spam requests to the Web site, each request with a fake referrer, in order for obtain a link from the Web stats page.

To see the effect of this, take a look at the referrer report (http://thinkcycle.media.mit.edu/webalizer/usage_200211.html#TOPREFS). Of the top 30 referrers, it appears that only four are valid. The remaining 26 appear to be using referrer spam in order to "negotiate" a link from this PR6 page on mit.edu to their own site.

Look at the other referrers! Do you really think it likely that sites like these...

http://adult-sex-toys-movies.com/adult-movies/
http://affordable-prescriptions.net/buy-viagra/
http://russiangirlagency.com
http://natural-herbal-supplements.com/Epidril/
http://prescriptionz.net/adipex/

...are sending real visitors to http://thinkcycle.media.mit.edu/?

Don't make the same mistake. Password protect your Web logs. Or at least filter the spam out of them before you publish them.

One more thing to note: the top visitor to this site, with 16803 requests (each of a single page) during the month, was ip68-103-114-7.ks.ok.cox.net. (See http://thinkcycle.media.mit.edu/webalizer/usage_200211.html#TOPSITES for details.) Look out in your own logs for suspiciously high numbers of requests from a single source.