kasia in a nutshell

View the source of the referring site. Most likely they have put an [img src='http://your/url/'] in their source. If so, then it's not a bot -- those 1574 unique IP addresses you're banning are customers who are simply visiting that porn site in their browsers. They've never heard of your site, don't realize they're contributing to your referrer spam problem, and no amount of IP banning will help stop the flood of new customers.

It happened to me, which is why I know about it. When I looked at the source I saw 30 other img tags, all targetting high-profile blogs. I redirected the requests based on referrer to a password-protected file, so any customer who tries to visit the porn site gets a password challenge dialog with a rude message. I believe that got their attention, they removed my img tag and I haven't heard from them since.

hm, clever tactic, that didn't occur to me.. you're right, that's exactly what it is. I didn't ban the IPs.. I assumed they were hijacked pc's or open proxies (too many IPs) and just used rewrite rules to re-direct the traffic at someplace else.

Thanks Mark.

Hm, just occured to me.. not only slimy in how they try to generate traffic, they obviously don't care much about their users' privacy.. I inadvertly published a list of IPs of users who visit porn sites.. heh, that's funny.

*sigh* And for one glorious moment I though my blog was really really popular ;)

Just find the image they link and replace it

:D

They don't link to an image. They link directly to your home page, but within an img tag, so visitors will hit your page trying to download the image. It won't display because it's not a valid image, but the damage (showing up in your referrer logs) has already been done.

Yep, the same scumbag is screwing up my logs too -- and I'm seeing akiraweb as well: http://jmason.org/refs/200308/ALL_PAGES.html (under /html). Nice company you're keeping there, Akiraweb!

Some points:

1. it's not loading from users' web browsers through IMG tags etc. AFAICS. I visited the 8thstreetlatinas site, checked the source, and checked my referrer logs to see if my access had resulted in a hit on jmason.org -- no sign. (although maybe it only works for MSIE.)

2. it's not open proxies; I checked that last time I got a bee in my bonnet about it. None of the hosts seem to have the right ports open.

3. However all of them AFAICS were running Windows 2000 or XP with MSIE -- so my theory is that it's tied in somehow to some scummy adware that affects users on Windows, and then without their knowledge, goes off hitting sites with referrer spam.

4. Akiraweb's WHOIS info is dodgy: Web, Akira mcpimp@mail.ru, PO Box 2521, Scottsbluff, NE 69361, US, (714) 734-8374. A PO box and a freemail address? That's exactly the kind of solid, reliable company *I'd* want to host with I don't think ;)

I've been trying to screw about with the clients, but they seem to be relatively resilient; e.g. returning an illegal 40-byte HTTP status code is ignored, and dumping 800Kb of data back at them from /html doesn't seem to have any effect. So I think they may be using MSIE (at least the URL control part).

I think I may try those mod_rewrite rules.

oh -- forgot to mention -- the problem is definitely lessening now that I put all my log analysis stuff into robots.txt as "noindex", AFAICS. So I think getting Google Page Rank is the aim.

Some more for your list from my supply this morning :(

RewriteCond %{HTTP_REFERER} dildo-sex-deep\.com [OR]
RewriteCond %{HTTP_REFERER} fetish-sex-bizarre\.com [OR]
RewriteCond %{HTTP_REFERER} free-porn-pics4u\.com [OR]
RewriteCond %{HTTP_REFERER} hairy-pussy-only\.com [OR]
RewriteCond %{HTTP_REFERER} huge-boobs-babez\.com [OR]
RewriteCond %{HTTP_REFERER} huge-cock-guys\.com [OR]
RewriteCond %{HTTP_REFERER} mithology.org [OR]
RewriteCond %{HTTP_REFERER} naked-celebrities-yard\.com [OR]
RewriteCond %{HTTP_REFERER} pissing-women-pix\.com [OR]
RewriteCond %{HTTP_REFERER} teen-sex-zone.net [OR]
RewriteCond %{HTTP_REFERER} tranny-sex-shemales\.com

All coming from 216.127.74.43 and 64.237.60.52 (blocked at the firewall for me now).

*sigh*

(feel free to edit the above comment to move those onto a separate page... just realized after I posted that that I'm probably helping the bastards :( )

According to my MySQL logs, my referer spam trickled to a stop over roughly three months after I restricted access to my log analysis pages. It appears that they're after search engine rankings...

I was just viewing this post and something occured to me. What if a rival company is doing this to Akira Web? I've scene this done with email spam a million times to degrade a company's image. It doesn't sound to me like Akira Web would really gain anything from doing this.

When I do a whois on jinxco.net..

Akira Web
PO Box 2521
Scottsbluff, Nebraska 69361
United States
information@akiraweb.com

Looks familiar? Why is Jinx defending Akiraweb? Oh yeah.

Yah, it's getting pretty bad.

Thanks for the Rewrite Rules, Geek Stuff & Arcterex!

Matt.