httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Joshua Slive <>
Subject Re: [users@httpd] Out of control Referrer spam; I'm puzzled.
Date Mon, 05 Dec 2005 15:59:44 GMT
On 12/5/05, Gene <> wrote:
> Hi All:
> I don't know about everyone else, but Referrer Spam on my site has
> reached epic proportions. I've been reading up on it, but one thing
> still puzzles me.
> If the referrer url is phony and the ip address from which it came is
> phony, how does that benefit the spammer? It seems to me that the url
> that got posted to a stats page would simply be a dead end.

I haven't checked myself, but I would guess that in general the
referer urls are not phony.  You may just have hit some cases where
the site was shut down before you got to it.

> 1. Is it possible to redirect the http request back to the referrer url,
> thus letting spammers with valid urls spam themselves?

There's no point in that.  Their client is highly unlikely to follow reidrects.

> 2. Is it possible, using the commonalities above, to prevent them from
> getting into the log file? Can apache simply drop the request making it
> appear there is no server running?

Yes, you can prevent them from getting into the log files.  See the
conditional logging section of

> 3. Can the referrer url be validated before accepting the http request?

Theoretically yes.  But this would slow down your site!  And I know of
no way to actually impliment this with current modules.

> 4. Since my page shouldn't be linked to from anywhere else, except maybe
> search engines, is it possible to create a sort of whitelist of referrer
> urls and reject all others (letting the request drop into a black hole) ?

Yes, see the "prevent image theft" example here:

> Anyway, anyone find a way to deal with it that at least reduces the
> spam? My ISP graciously allows me to run a server as a hobby, but if
> this spam keeps increasing, they're liable to consider me a commercial
> enterprise.

In general, you should just be ignoring this stuff, with two possible

- Make sure you don't post your logfiles to let them benefit from the spam.
- If they are hitting very large pages, you can save some bandwidth
and server load by blocking them using one of the techniques mentioned

But there is no way to prevent the requests entirely other than
finding the computer that is doing it and unplugging it from the


The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:> for more info.
To unsubscribe, e-mail:
   "   from the digest:
For additional commands, e-mail:

View raw message