0

I see relatively many referrers such as the following (as reported by Webalizer) in a web server log. The server is located outside Russia and it's a small one.

  8     3  http://tiandeural.ru/ 
 19     3  http://timetorest.biz/ 
 20     3  http://vigrx-original.ru/ 
 21     3  http://www.rukinolenta.ru/
 22     2  http://www.arenda.triumf-realty.ru/

What is going on here? Why are all these entities (or single entity) taking the trouble of referring (perhaps even linking) to the site? Is this some attempt to increase page ranks or an attempt to draw naive admins to (perhaps) phishing sites? In any case, the pattern looks suspicious and I am wondering if there is any better reaction than just ignoring such blocks of apparently odd refer(r)ers.

2

There is a thing called Referer spam, of which your case may be an instance.

Alternatively, the requests may be part of some sort of automated crawling and testing for possible vulnerabilities, and the attacker includes random HTTP referer header values as a way to make the requests look more "genuine" and thus bypass some basic intrusion detection systems. When you have a server online, you soon get lots of very stupid requests from mindless botnets which look for new hosts to infect, and can afford to try random IP addresses blindly with attack attempts which work on only one in a million machines (botnets are patient).

Best thing to do is to ignore them. The real problem with such requests is that they reduce the usefulness of logs, and may make you miss some important clues about more targeted and dangerous attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.