• Starting today I’ve begun getting seeming referral spam from random wordpress blogs. In my stats page they show up as links to my site but invariably are from archived posts six months or older from random blogs that have nothing to do with linking my site.

    I’ve done a fine job with keeping up with the various types of referral and comment spam, but this seems peculiar and I’m not sure how to respond to it.

    At this point it’s just a bother… but I’d love to get on top of this before I start getting massive amounts of what seems to be referral spam but isn’t pointing at malicious or ad sites.

Viewing 15 replies - 46 through 60 (of 86 total)
  • technically, the idea behind bad behavior is that bots, as the name suggests, behave bad. it’s a good idea, that will likely keep script kiddies from massacrating your site, but i’m afraid it won’t stop the bots of more serious spammers for very long.

    the thing is, bots that identify themselves as users do not bother to send the headers that normal users send. and this is how bad behavior detects that they are bots. thus, if your bot behaves like a user, bad behavior will not stop it at all.

    Moderator James Huff

    (@macmanx)

    Volunteer Moderator

    There’s a little bit more than that, but you’ve pretty much hit the nail on the head. There is also a pre-defined list of known bad bots (like wp-trivial). The rest of the criteria can be seen here: http://www.ioerror.us/software/bad-behavior/412-precondition-failed/

    Not to belabor this topic, but last night I saw yet another referer spam in my apache logs. I took a look at ioerror’s plugin, and decided to give it a shot. Installed fine.

    This afternoon, guess what.. more of the same type of spam, and his plugin didnt stop it.

    I can tell you this —

    1. they are using proxy ips. Ive recorded all of them
    2. they all coming from wordpress sites, and old topics
    3. all but one of them has no visible spam on the offended referering page
    4. They all send the same user-agent [ “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)” ]
    5. They all call pages on my site using the same URI structure, and its not my chosen permalink structure. [ GET /index.php?category_name=irritations/&paged=2 ]

    This isnt a call for help. Its a headsup in the event anyone else watches their logs and happens to see something similar. I plan on taking care of it outside of the plugin for now.

    whooami – I made a post earlier on my blog after reading about this referer spam in many places today.

    Comment spam hurt blogs, so people acted to stop that.
    If referer spam is not seen to harm our blogs, then why should we be bothered ? And if our site stats are not visible, again, why bother ?

    I went from banning everything to now banning very very little, but if this referer spam is a Bad Thing, why ? (and this is a genuine question – I cannot find something which sets out the arguments other than “Spammers are evil”)

    About the only thing I can think of on this is that it’s a bandwidth waster. For some people, that can be critical.

    I thought that, but how much are we talking about ?
    And what’s the point of it ? I guess it’s for those damn idiotic sites that have sidebar lists of “The last 500 referers!!” but surely this is even more overkill than comment spam ?

    Well, yeah. But the world is full of really silly people, podz. As to how much we’re talking about, I couldn’t say myself, but someone I know on another list had to boost his hosting package because of referral spam alone. So I guess some people are hit a lot worse than others as well.

    Thanks, podz. I have one of those “damn idiotic sites”. Just thanks.

    “had to boost his hosting package because of referral spam alone.”

    Now that I get. I’ve had to do boost before and it was damn expensive.

    jennmiller, I’m pretty sure podz meant sites which have garbage referrals, rather than good info like yours….

    jennmiller – I aimed that at no-one in particular, I was speaking generally.
    To illustrate:
    MSN search for ‘blogspot referers’ gives this as #1
    http://www.nocblog.com/
    HostRocket Network Operations Center Blog
    and they have their referers on display…

    well podz, somehow I am not surprised that you would challenge me (of all people) with that question 🙂

    In a nutshell : spammers are evil” is ALL it takes for me.

    However, there are more practical reasons for fighting referer spam:

    1. not everyone has 40GB of bandwith to spare a month. I do, but not everyone does. I know of people that have seen their month’s allotment of bw desimated by spammers. The pages that have been called on my site are believe or not about 40kB in size each, after you tack on images and what not. Thats a hefty chunk when it happens repeatedly. Ive seen, I think, 5 of these hits in 1.5 days– so lets use these numbers (and I think is a low estimate) :

    15 days at one hit = 585MB
    15 days at two hits = just over 1GB

    1.5 GB of bw wasted on spam in a month, and thats just referer spam, that doesnt account for any other mishaps that might get through.

    2. Many people watch their logs for other reasons than to battle spam. I, for instance, like to know where my traffic comes from, what pages people are looking at, etc.. Bogus referers clutter logs, and make me have to work — check the referer, is it real, is it fake?

    3. “If referer spam is not seen to harm our blogs, then why should we be bothered ?” Is this a question, or an assumption, or a statement? It’s clearly arguable that ALL types of spam hurts ALL web sites, not just blogs.

    I believe that any concerted and continued effort that web masters make to thwart spammers is not only good for themselves, its good for other web masters as well. We are symbiotic in that regard.

    4. Lastly all spam is evil. And I like the idea of battling scourge. It’s also a rather rewarding endeavor when you win.

    Thread Starter dualravens

    (@dualravens)

    whooami, if you get things settled, can you post how you did it. It’s just a trickle still for me but it continues and I’d love to learn how to get my stats accurate.

    podz, for me this isn’t that big of a deal. I was getting mass referral spam and comment spam before and have settled this mostly by .htacces. Mostly, it has to do with being able to see who really is linking to my site. If my stats get slammed with fake links then I don’t know who is really connecting with me. It’s a bother more than anything. But, bothers like this can possibly point to major problems later on so if I can understand how to stop the trickle I don’t have to face a flood.

    whooami – thanks 🙂 You just happened to post here after I had pondered the issue.
    We have had people ask here about it, and what we didn’t have is something to point at (we now do!) so that people can see the damage that will be caused – and a site being taken down by a host until a bill is paid is an incentive I would hope.

    I would say that many people do not check logs, after all they are not the most user-friendly of docs and who knows if people do keep an eye on bandwidth consumption (something that I certainly do watch)..

    Like dualravens said, if we have a trickle now then we need to stop the flood or at least point things out in a way so that people can actively choose and are not blinded by jargon.

    FWIW, I use bad behavior and referer-karma. My .htaccess is reserved for the blocking of the even more evil GWA 🙂

    Moderator James Huff

    (@macmanx)

    Volunteer Moderator

    if you get things settled, can you post how you did it.

    This shouldn’t be too hard to block. We’ll combine the information from Whooami’s list item #4 and this Codex article. From that combination we can conclude that adding the following to our .htaccess file should stop the wave:

    SetEnvIfNoCase User-Agent Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) spammer=yes

    Order allow,deny
    allow from all
    deny from env=spammer

Viewing 15 replies - 46 through 60 (of 86 total)
  • The topic ‘referral spam from random wordpress blogs’ is closed to new replies.