OT: Spamming Log Files?

Jason Stephenson jason at sigio.com
Wed Apr 30 22:41:58 EDT 2003


I don't very often check my apache access log files except that I 
occasionally take a glance when logged in doing something else on my web 
server, or when I sense that there might be a problem. (For a short 
time, I was running webalizer and had a monthly log rotate script 
running and then I had a disk crash that affected the partitions where 
my logs were stored and so lost the logs. No, I don't back up my apache 
logs since the data isn't that important to me.)

Anyway, I logged in to update some of the software on my web server this 
afternoon and took a glance at my log files. I noticed something 
peculiar. There are 274 lines of roughly the following format:

66.150.40.75 - - [09/Apr/2003:05:55:36 -0400] "HEAD / HTTP/1.1" 200 - 
"-" "sitecheck.internetseer.com (For more info see: 
http://sitecheck.internetseer.com)"

(I'm afraid my MUA, Mozilla, is breaking that line up.)

I didn't go to the web site, but this doesn't appear to be the typical 
entry for a bot or a site checker (like a "what is that site running" 
type of thing). Because of the frequency of the entries (12 so far for 
today) and because they are scattered over a period of time and the user 
agent appears to be an advertisement, I'm assuming that they are 
attempting to "spam" my log files.

I suppose that they hope it would work like this: They become the #1 
user agent in my log files, or at least high enough to get listed in my 
log analysis software. I, out of curiosity, visit their site. I like 
their software or whatever their deal is and supposedly buy it.

Does that sound about right?

Anyway, I'm not overly concerned about it, but it looks like there might 
be a new trend in advertising brewing, or has this been going on for a 
long time and I've just not noticed until now?




More information about the gnhlug-discuss mailing list