I'm not sure which forum to post this in, so I thought I'd start here.

I noticed this odd referrer URL (ebay.com)on my website statistics the other day and when I looked back in the statistics a few months ago, I found out it has been going on for a few months. I was curious as to why ebay.com was linking to my site.

I thought that someone was hotlinking to the an image on the site but got this back from the company.

I have contacted the host company for the site, and received this reply

We don't believe there is any hotlinking going on, it's just a bit curious as to what exactly is going on. basically, someone is requesting the file "http://www.ebay.com"; when connecting to your account. your default page is being returned to them.

so essentially, it's no different than someone requesting "file.html" on your account (ie, browsing that page) but as to why they're doing it i'm not sure, i haven't heard of any sort of scam or similar which uses this technique, so it does seem quite harmless,

Has anyone heard of this? Any idea why this is happening? I'm not sure it is "harmless" and have concerns someone is bouncing an illegal spam or scam off my site.

Can anyone help?

Thanks

Firstly it sounds like your hosting company don't know what they're talking about. If it is in fact a referer, then nobody will be requesting that URL as a file from your site...

Can you go into your web logs directly and search for ebay.com ? You can then find the full referer URL and find out where in eBay is linking to you, and which file it's linking to (assuming of course that it isn't a spoofed referer)

No, I can't access any other information other than the URL referer of http://www.ebay.com. I am getting anywhere from 8 to 12 hits a month from that referrer. Now I know ebay.com isn't linking to my site (it is actually a church site) so that's why I'm concerned it is being used for something illegal--especially since it is a church site. I was wondering if maybe someone isn't using it to send out those "fishing" emails that appear to be from ebay.com but aren't?

It has me completely baffled.

I just heard from my domain host again. Here's what they said:

a few of the IP's belonged toa chinese company (in china). Thats not much help though. As to why they are doing this there are a number of possibilities. It could be connected to hacking attempts against ebay or it could actually be a harmless mistake. As you say in this case there is almost no way to know.

One thing though is that this type of thing is relatively common and probably happens to just about ever domain out there. In your case the number of entries like this is actually relatively few and does not seem to indicate a threat of any kind to your site.

I still have concerns though. Is there a reason to be concerned? Is this as common as they state?


Thanks again,

I doubt there is. It sounds very much like chinese hackers to me.
For now it looks like they're not trying to target your site (Would they have a reason to?) If they wanted in they probably would be by now, or given up.
I can't explain why it's happening still. It would help to see the raw logfiles, and to know what files on your server are being requested.

Ok, thanks. I'll keep an eye on the stats and make sure that it doesn't increase or get worse in some way.

No, there's no reason for them to hack the site. There's no personal information on there--nothing that isn't available to the public by accessing the site "the normal way."

Thanks again.