General Discussions

**goheadtry** · 06:41 PM

I got these links in my AWSTATS it says these sites link to me but when I click the link it redirects to yahoo weird HUH? These are examples of these wierd links

< removed See post #5 >

I was wondering if anybody knows what these are and if any one know why these turn into yahoo.com but they say they are linked to me?

I am just wondering

**ForrestCroce** · 08-12-2007, 01:48 AM

Neither of them redirect to Yahoo; the first is hardcore digi-porn, and the second is an online "pharmacy" aka dealer. Would be kind of you to edit the message and delink them so as not to expose the forum to linking to bad neighborhoods.

They aren't actually liking to you; this is referral spam. They just got two "seo-friendly" links out of you in this forum, you clicked and so did I to see where the links go, so they got some traffic. Some web servers publish their logs to the outside world by default, which gains them another link.

Someone is using a special type of 'bot that spoofs the referral.

**goheadtry** · 08-12-2007, 01:00 PM

Okay I removed the clickable link but in I must also say I am using Firefox.
and it redirects to yahoo when I clicked those.

P.S. It still redirects to yahoo on my computer

**ForrestCroce** · 08-12-2007, 01:22 PM

I'm using FireFox as well ... that suggests that you've got a more intelligent spammer than average on your part. Email yourself the links and try them from another computer?

This theory is a bit far fetched, and hopefully someone with more knowledge will come along and fill in the blanks ... but my guess is the servers behind those links have identified you somehow. Either by IP address or cookie would be my guess ... and if that's the case, I would guess some directory owner added you to a database when you submitted, and is referral spamming you on behalf of their client. When you click the links, as the site owner, they redirect to Yahoo to hide what's going on, but when I click them, and I'm guessing it's not just me, they serve up porn / pharmaceutical content. I can send you a screen shot if you'd like ... PM me your email address if you'd like me to.

I get more referral spam entries in awstats than I can count. Everyone from sports gambling to porn. You have to log in to see my stats, so it's a minimal problem, but still a minor irritation. The unique visitor count includes this garbage, it puts minor strain on your server answering dummy requests, and it makes it more difficult to make sense of your logs.

In the end, it may not be worth doing anything over ... or you could use whois to find the IP of these two sites, and any other offenders, and ban them via .htaccess if you want to put an end to it. But referral spam has been around forever ... and ChrisHirst is a walking encyclopedia on the subject.

PS - Thanks for making the links non-clickable!

**chrishirst** · 08-12-2007, 06:39 PM

definitely referer spam and added to my ever growing list of blocked hosts.

at a guess I would say you have some filtering installed into your browser or some IS (Internet Security) software installed.

Both pages are bog standard crash & burn spammer doorway page style javascript redirects so you may have something that inhibits the redirect and send you off to a harmless location.

or if you are browsing from an office location via a proxy the IT admin may have enabled filtering and pushing all banned IPs and/or sites to Yahoo!

I will delete the URLs from the post as we do not want to be leaving the definitely HC pr0n site even as a cut and paste visit.

should anyone want to know the URLs PM John, Forrest or myself.

**ADAM Web Design** · 08-12-2007, 07:48 PM

I would like to see them, but I'm too lazy to PM.

**ADAM Web Design** · 08-13-2007, 10:32 AM

Okay, Hirst sent me the URLs. These are definitely referrer spam URLs. They're nothing to worry about, though.

My guess is that they're doing some form of user agent/bot detection, sending the bots one way and sending people another. In my case, they're sending me to yourmegasearch.com within both Firefox and IE, via jii.be.

The first one is definitely a Javascript redirect. On the carisprodol site, there's a file called rd.js with your redirect code. Here's the code, for those who are masochistic and want to try and figure it out:

Code:

var mrgiknizckchp545 = 'on=';
var zayyrlwwesdkz620 = 'cvmri222';
var vsvlawv979 ='ment';
var lyxmnsapti717='.lo';
var zjpocetmih841='ti';
var ba291='docu';
var lrhfgyyj637='&parameter=soma+carisoprodol';
var tcf92='http://jii.be';
var ivvzwlapewkpryf73='/fds/in.cgi?18';
var cvmri222 = 'ca';
var lzscoidkk408='"';
if(zayyrlwwesdkz620 = 'cvmri222')eval(ba291+vsvlawv979+lyxmnsapti717+cvmri222+zjpocetmih841+mrgiknizckchp545+lzscoidkk408+tcf92+ivvzwlapewkpryf73+lrhfgyyj637+lzscoidkk408);

(Hint: replace their variable names with real ones and this code will make much more sense).

I don't see your site in there anywhere, John. At any rate, I wouldn't worry about this. It's not really doing you any harm...it's just a cheap attempt to get visitors. I see at least 20-30 of these in any given week, depending on the site.

**goheadtry** · 08-13-2007, 01:55 PM

Maybe my IP
var cvmri222 = 'ca';
may that indicates california

**dansgalaxy** · 08-13-2007, 05:26 PM

is there a publicly avalible list of ips so site owners and hosts etc can easily banthem from their servers

i really want to have a way to ban ips ( adn i would like to have it ina c ontrol panel so can login and just append a ip to the list when i find them)

what the best and easiest way to do this?
thanks,
Dan

**chrishirst** · 08-13-2007, 06:14 PM

I use server side code to give referer spam bots a HTTP 403 response

I'll write the code and DB structure up as an article one day

for Apache you can use "deny from spammers" method

http://www.webmaster-talk.com/msn-fo...tml#post433941

see posts 10 & 11

**dansgalaxy** · 08-13-2007, 06:32 PM

well yes this is how i would want to do it with server side and db

but im a little hesitent becaus ei thin maybe havin a script query a db with possible thousesands of entries and matching agains the current ip could cause a little lag. especially as it owuld be on every page.

i have a question tho. in PHP how could u completely stop a script if something failes with out puting it in if/else have having to put the } at the end

i hop you get what i mean so for instance soemthing like

PHP Code:


			
<?
if(x == $x) 
{
Function_to_stop_entire script running;
}
 
SCRIPT SCRIPT SCRIPT
?>

also if i was to have the db thing,

what would i have to have to convert a list of ips into spertae entries in a table?

im guessing a while but no clue how i could do it and have it check if that ip is already in the thing?

so like i could have a txt file or just a string of ips or something?

thanks,
Dan

**Learning Newbie** · 08-13-2007, 06:38 PM

Quote:

Originally Posted by dansgalaxy

but im a little hesitent becaus ei thin maybe havin a script query a db with possible thousesands of entries and matching agains the current ip could cause a little lag. especially as it owuld be on every page.

so like i could have a txt file or just a string of ips or something?

Doing a lookup ( not to mention maintenance! ) against a database is going to be millions of years faster than a text file!

**dansgalaxy** · 06:45 PM

sorry my fault with my randomness in that last post,

when i was talking about a text file, i was think for converting a text file with a list of IP's into databse entries...

so i would wnat to know how i could have

a textarea form, which whe submitted, each ip in the field is added into a db

but i have no clue how.. im guessing with like taking ever one between blank space? :s

anyone feel like doing soem example code please

ill TP

**Learning Newbie** · 08-13-2007, 06:51 PM

Quote:

Originally Posted by dansgalaxy

anyone feel like doing soem example code please

ill TP

Sure, but I need more info. Like the data and structure of your data. If it's just a text file, do a search and replace to add an INSERT/VALUES command around each IP.

**dansgalaxy** · 08-13-2007, 08:37 PM

well basically i would need is a script which has a form

Code:

<form action="this_script.php" method="post">
<textarea></textarea>
<input type="submit" value="Add Ips to Ban list" name="submit" />
</form>

like that and then the the php which would seperate them and then insert them into the db..

Dan

**ForrestCroce** · 08-13-2007, 09:41 PM

Well, pick out a delimiter ( comma, space, newline, whatever ), have the script that the form posts to do a string.split on that delimiter, then iterate the results in a loop and insert each IP into your database.

**dansgalaxy** · 08-14-2007, 09:42 AM

yea..thats my problem... i think i could manage a loop with the while() but thats about all i know.

**goheadtry** · 08-19-2007, 06:29 PM

I know with some sites occasionally maybe once every few months my dsl gives me an IP that is band on some sites so I just reset my IP
and I have no knowledge to why they would ban an IP that changes

**ForrestCroce** · 08-19-2007, 10:07 PM

Quote:

Originally Posted by goheadtry

I know with some sites occasionally maybe once every few months my dsl gives me an IP that is band on some sites so I just reset my IP

How do you force a new IP? Mine can go months without changing ... I really don't like this, because it puts me at a higher security risk. But I run software that crunches numbers about the human genome to help with aids and cancer research, so I leave my computer running 24/7. I've found ipconfig /release and ipconfig /renew don't work; I just wind up with the same address after giving up my connectivity for a few moments. I know if I leave it disconnected for a week someone else will come along and pluck the IP address I've been using ... but that's really not a tenable option.

Any advice on that? It's probably isp by isp, and mine is Comcast, in case anybody does have some advice.

Quote:

Originally Posted by goheadtry

and I have no knowledge to why they would ban an IP that changes

Ignorance? Or maybe they have a list of static IPs that are "safe" to ban? I've been too uncomfortable with the idea of banning IP addresses in most cases, and especially ranges in a world of DHCP. I actually ban one particular IP address that's connected to an image hosting site, but a web site or service isn't likely to play musical addresses...

**goheadtry** · 08-20-2007, 01:15 AM

Look inside your modem or router if there is no option look
some times there are hidden places so look it up on google using your router company name if you still need help contact me,PM me or IM me I used the ipconfig before I got my new modem now it doesn't do it unless it is done in the modem using the modem page through http: