{"id":146,"date":"2004-04-16T15:42:59","date_gmt":"2004-04-16T14:42:59","guid":{"rendered":"http:\/\/wp.devco.net\/?p=146"},"modified":"2009-10-09T17:25:47","modified_gmt":"2009-10-09T16:25:47","slug":"distributed_referer_log_spamming","status":"publish","type":"post","link":"https:\/\/www.devco.net\/archives\/2004\/04\/16\/distributed_referer_log_spamming.php","title":{"rendered":"Distributed referer log spamming?"},"content":{"rendered":"

I always look at my web server logs, I find the various log spammers, bots and RSS readers really interesting. About a week ago I noticed a lot of log spamming all in a short period of time and thought something must be going on but waited till it happened again.
\nToday again I got 5 log spam attempts in a very short interval from different IP addresses. As this is the 2nd time this happens I can only imagine this is 5 machines that is acting in a coordinated fashion.<\/p>\n

\n64.69.172.9 – – [16\/Apr\/2004:15:29:46 +0100] “GET \/ HTTP\/1.0” 200 32759 “http:\/\/www.nudecelebblogs.com\/” “Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.0)”
\n201.128.123.11 – – [16\/Apr\/2004:15:33:09 +0100] “GET \/ HTTP\/1.0” 200 32759 “http:\/\/paris-hilton-video.blogspot.com” “Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.0)”
\n212.163.30.100 – – [16\/Apr\/2004:15:34:15 +0100] “GET \/ HTTP\/1.0” 200 32759 “http:\/\/www.shatteredreality.net” “Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.0)”
\n217.219.165.3 – – [16\/Apr\/2004:15:34:46 +0100] “GET \/ HTTP\/1.1” 200 32861 “http:\/\/britneyspearsnude.blogspot.com\/” “Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.0)”
\n80.58.35.46 – – [16\/Apr\/2004:15:37:23 +0100] “GET \/ HTTP\/1.0” 200 32759 “http:\/\/www.amateurxpass.com” “Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.0)”\n<\/p><\/blockquote>\n

The IP addresses are in US, MX, ES, IR and ES and interestingly enough have exactly the same user agent. 2 of the machines are running mail servers and may also be NAT\/Masquarading machines I am guessing.
\nEitherway, I think someone is controlling a bunch of bot machines and using them to spam logs. I wonder if I contact the hosting companies of these sites if they will shut them down?<\/p>\n","protected":false},"excerpt":{"rendered":"

I always look at my web server logs, I find the various log spammers, bots and RSS readers really interesting. About a week ago I noticed a lot of log spamming all in a short period of time and thought something must be going on but waited till it happened again. Today again I got […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","footnotes":""},"categories":[6],"tags":[10,29],"_links":{"self":[{"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/posts\/146"}],"collection":[{"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/comments?post=146"}],"version-history":[{"count":1,"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/posts\/146\/revisions"}],"predecessor-version":[{"id":836,"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/posts\/146\/revisions\/836"}],"wp:attachment":[{"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/media?parent=146"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/categories?post=146"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/tags?post=146"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}