Log spamming—which log files to protect and how?

*dmarkham* · 05-31-2004, 04:57 PM

I've noticed that my log statistics have begun showing a number of linked sites that aren't linked to mine at all. Some research indicated that I'm probably being subjected to someting called "log spamming", a practice which I'm still trying to get my mind around.

Anyway, it seems that my logs may be "world readable", and that I should probably password protect them to reduce my risk from this. My question is which log files should I password protect, where do I find them, and how do I do this (I'm figuring that it involves clicking on the "Password Protect" button beneath the index table)?

This log spamming doesn't sound fatal just rather annoying, but I'm having enough trouble trying to understand my statistics without this added distraction.

Thanks,
Dewey

*hobbes* · 05-31-2004, 05:45 PM

Password protect your www/stats/ directory. If unprotected, anyone can view your log files (and log spammers take advantage of it).

*dmarkham* · 06-01-2004, 04:41 AM

Hobbes, thanks for the reply. I see that there is already a blue padlock icon on the folder—thus, it's already password protected (with my default FQ password), right? So I suppose I should be shielded from log spamming, or do I suppose erroneously?

*cindik* · 06-01-2004, 07:03 AM

My stats are password protected. I still get logspam. All they do is access your web pages with a forged referrer - poinying to their own site.

*Andilinks* · 06-01-2004, 12:56 PM

I was troubled with log spammers for a long time, and though there were quite a few referrers they seemed to all come from just a few IP's. Blocking the IP's with .htaccess did not stop the referral from showing up on the log, however shortly after I blocked them the referrals stopped. It's worth a try.

The IP's that I blocked for this were:
218.93.5.48
218.93.7.43
61.177.77.168
but they may be using others now...

These URL's seem associated and all this comes from (where else) China, though the referrers seem to be mostly European, .ne, .de, .fr, etc.
http://www.tradedoubler.com/pan/index.jsp
http://www.com/search.jsp

I once thought to complain to the sites being referred, but none had any contact information, which leads me to believe that the referred sites are being scammed by an seo firm or are maybe the victims of some click-fraud scheme.

Andi