SteveJamieson.com

If you tried visiting my site in the past 24 hours you probably received a 403 Forbidden error. Last night I was apparently on the receiving end of a ginormous referrer spam attack. What’s a referrer spam attack, you ask?

Here’s how it works. Whenever you attempt to visit a web page, your browser sends an HTTP request to the server, which specifies the file that you want as well as some other information about your browser and such. If you request a page by clicking on a link, the URL of the document containing that link is sent in the HTTP request. Web servers log these HTTP requests and then log analysis tools can generate statistical reports.

My stats have been publicly available (if you knew where to look), and one of the parts of the reports is top referrers, so I can see where traffic to my site is coming from. The addresses in the referrer report are live links, so when Google’s web crawler indexes my site, it sees these top referrers as sites that I have linked to, which increases their PageRank score. Therefore, if a devious individual can have a bunch of zombie computers make a bunch of bogus HTTP requests with the perpetrator’s site as the referrer, this nefarious person can get a link to their site on mine and thus increase their web site’s rank in Google searches (or perhaps more likely the weight that Google gives to their site when determining the rank of the pages that others may pay them to link to).

I’ve known that this sort of thing has been going on for some time, but the referrer spam that I’ve seen has always been rather light—just a small (though not insignificant) percentage of the traffic on my site. Last night, however, my server was being hit so hard that the server was being overloaded and my web host had to block all web access.

You’ll notice that web access has been restored, although, for now, only if you enter the address directly. Referred traffic is still blocked, so trying to access my site from a link on another site will still be blocked. Perhaps I’ll go in and unblock some of the legitimate sites that I know link to me.

This entry was posted on Wednesday, November 29th, 2006 at 10:58 PM and is filed under Site News, Technology, Villainy. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.