Learn Time's Info Center

Tuesday, March 23, 2004

Referrer Spam and the ongoing battle

What a battle against the low life scum that resort to Spam of any type, especially the new one I have recently learned about...referral log spam.  The connected text is a string of email between me and the abuse folks of the service provider of said scum.  Since it’s an email thread, you need to read from the end forward to have it in the right order.

I appreciate this explanation.  I’ve contacted our customer regarding this issue.

Regards,
Janna
Ev1Servers Abuse Team

________________________________________________________________
----- Original Message -----
From: Rick Harris
To: ‘EV1 Abuse Team #520’
Sent: Tuesday, March 23, 2004 11:19 AM
Subject: RE: referral log spam from fat-young-girls.com and gigantic-boob.net

Here’s what it means in a nutshell.

Look at the amount of data transferred in each of the log entries.  A normal visit to my index page from any other referrer generates about 24,000 bytes of data transfer.  However, every entry where your site is the referrer generates a data transfer of 280 or so bytes.  This is just enough data transfer to account for a log entry.  I seriously doubt that I have literally hundreds of unique IP addresses that are committing this fraud on my logs and just innocently adding your client’s domains as the referrer.  I have to believe the reverse.

Now, since there are no links to my site on either of the domains in question, and only enough data transferred to account for the log entry this is telling.  This tells me that the referrer is running some type of script or bot to spam my logs.  They have successfully identified my site as a “weblog”.  Weblogs frequently have their referrer logs available for public view.  In my view your domain owner is unethically trying to increase traffic to his site by fraudulently adding his sites into my logs as referrers.  It is becoming increasingly common unfortunately.  Just do searches for referral log spam and you will see what I mean.

Rick Harris

________________________________________________________________

-----Original Message-----
From: EV1 Abuse Team #520 [mailto:abuse@ev1.net]
Sent: Tuesday, March 23, 2004 10:59 AM
To: Rick Harris
Subject: Re: referral log spam from fat-young-girls.com and gigantic-boob.net

Ok, here’s a snip from the logs I’m looking at.  The domain name of ours is the referrer, but the IP the traffic came from is not ours, what does it mean?

Host: 210.168.234.117Url: /Http Code : 302
Date: Mar 23 06:52:09Http Version: HTTP/1.0"Size in
Bytes: 272
Referer: http://www.fat-young-girls.comAgent:
Mozilla/4.0 (compatible; MSIE 4.01; Windows 98; Hotbar
2.0)
________________________________________________________________
----- Original Message -----

From: Rick Harris

To: ‘EV1 Abuse Team #520’

Sent: Tuesday, March 23, 2004 9:59 AM

Subject: RE: referral log spam from fat-young-girls.com and gigantic-boob.net

Sorry…the attached text file is the current “latest visitors” listing from my site, saved in a text format.  You will see plenty of entries from unique IP addresses where the referrers are fat-young-girls.com and gigantic-boobs.net.  There are no links on either of those sites to mine, nor should there be.  My web site is a commercial web site providing products and services to the Educational community and has no association with porn or porn sites.

Thanks,

Rick Harris

________________________________________________________________

-----Original Message-----
From: EV1 Abuse Team #520 [mailto:abuse@ev1.net]
Sent: Tuesday, March 23, 2004 9:46 AM
To: Rick Harris
Subject: Re: referral log spam from fat-young-girls.com and gigantic-boob.net

Dear Mr. Harris,

The logs you sent are not in a format we can read.  Please resend in pdf, doc, or txt format.

Thank you,
Janna
EV1Servers Abuse Team

________________________________________________________________

----- Original Message -----

From: Rick Harris

To: ;

Sent: Monday, March 22, 2004 8:52 PM

Subject: referral log spam from fat-young-girls.com and gigantic-boob.net

Dear EV1Servers.net abuse handler:

Let me first off state that I don’t envy your job handling abuse claims...it cannot be pleasant.

Of late, I have been getting my referral logs spammed with fake referral links from two Web sites.  A current copy of my log file is attached in order for you to verify what I am reporting.

The common thread to both of them is the same contact a Mr. John Melt, the same company a Morpheus Corp of Helsinki, FI and the same dns servers.  A quick check of DNS servers leads me to EV1servers.net.

This flooding of my logs would appear to be a violation of #13 and possible #12 of the EV1Servers.net TOS http://www.ev1servers.net/english/aboutus/tos.asp

This is likely being done by some script or bot pointed at my Web server.  I would appreciate you expeditious assistance in eliminating this nuisance.

Thank you,

Rick Harris

Learn Time, Inc.