Deni Posted February 4, 2008 Report Share Posted February 4, 2008 I have some strange entries in my log:Sun 03 Feb 2008 11:11:01 PM Search Results http://www.thoseguysfilms.com/forums/templ...ges/uza/laqipu/ accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:57 PM Search Results http://www.elettrodataservice.it/foto_arti.../onoda/iyegimi/ accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:52 PM Search Results http://sahel55.com/articles/omaduro/kimumid/ accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:52 PM Source (http://www.alonsaunet.com/webmaster/romi/jirudog/) accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:51 PM Source (http://www.elettrodataservice.it/foto_articoli/onoda/iyegimi/) accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:50 PM Source (http://www.pattibus.it/phplib-7.2b/pages/ilosi/dohigal/) accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:46 PM Family Group Sheet for Family http://www.obrasmecanicasch.com/omch/img/itofu/viroja/ accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:46 PM Family Group Sheet for Family http://www.psikolojikyardim.org/etkinlik/include/eto/nixaz/ accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:45 PM Family Group Sheet for Family http://www.ce-cioceoforum.com/talk/t1/roda/ilubov/ accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:07 PM (http://www.psikolojikyardim.org/etkinlik/include/eto/nixaz/) accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:06 PM (http://www.elettrodataservice.it/foto_articoli/onoda/iyegimi/) accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:05 PM (http://www.service-exposants.com/store/punotag/ufacip/) accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:09:58 PM accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:09:57 PM accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:09:56 PM accessed by ns34122.ovh.net. When I follow any of those external URLs, I get a text page that says<?php echo md5("just_a_test");?>I have a robots.txt file that is supposed to only allow Google 'bots to the site, but obviously these folks aren't interested in following the rules. This isn't the first time this has happened.Is there anything I can do to get rid of this? Is this likely to cause a problem later on when the php code is not "just a test"? Or is it just annoying? Quote Link to comment Share on other sites More sharing options...
Micheal Mathews Posted February 4, 2008 Report Share Posted February 4, 2008 I have some strange entries in my log:Sun 03 Feb 2008 11:11:01 PM Search Results http://www.thoseguysfilms.com/forums/templ...ges/uza/laqipu/ accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:57 PM Search Results http://www.elettrodataservice.it/foto_arti.../onoda/iyegimi/ accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:52 PM Search Results http://sahel55.com/articles/omaduro/kimumid/ accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:52 PM Source (http://www.alonsaunet.com/webmaster/romi/jirudog/) accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:51 PM Source (http://www.elettrodataservice.it/foto_articoli/onoda/iyegimi/) accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:50 PM Source (http://www.pattibus.it/phplib-7.2b/pages/ilosi/dohigal/) accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:46 PM Family Group Sheet for Family http://www.obrasmecanicasch.com/omch/img/itofu/viroja/ accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:46 PM Family Group Sheet for Family http://www.psikolojikyardim.org/etkinlik/include/eto/nixaz/ accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:45 PM Family Group Sheet for Family http://www.ce-cioceoforum.com/talk/t1/roda/ilubov/ accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:07 PM (http://www.psikolojikyardim.org/etkinlik/include/eto/nixaz/) accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:06 PM (http://www.elettrodataservice.it/foto_articoli/onoda/iyegimi/) accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:10:05 PM (http://www.service-exposants.com/store/punotag/ufacip/) accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:09:58 PM accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:09:57 PM accessed by ns34122.ovh.net. Sun 03 Feb 2008 11:09:56 PM accessed by ns34122.ovh.net. When I follow any of those external URLs, I get a text page that says<?php echo md5("just_a_test");?>I have a robots.txt file that is supposed to only allow Google 'bots to the site, but obviously these folks aren't interested in following the rules. This isn't the first time this has happened.Is there anything I can do to get rid of this? Is this likely to cause a problem later on when the php code is not "just a test"? Or is it just annoying?What you have there is what is known as "referrer" spam. I have the same thing with my site and also with my community forums. What you need to do is block ovh.net in your htaccess, as I have never seen anything positive or remotely good from that place.Additionally, I would suggest that folks not follow links from logs files. I have javascript turned off when I visit dubious sites such as what you have found in your logs. Unfortunatley, this is how users get infected and unknowingly become victims of "botnets". Study up on htaccess, as it will become your new best friend now that the spammers have found you. Quote Link to comment Share on other sites More sharing options...
Deni Posted February 4, 2008 Author Report Share Posted February 4, 2008 Thanks much. I'll be more careful from now on.There were entries from two more of these today. I think my .htaccess file is going to end up very large. Quote Link to comment Share on other sites More sharing options...
Scotty Posted February 4, 2008 Report Share Posted February 4, 2008 Thanks much. I'll be more careful from now on.There were entries from two more of these today. I think my .htaccess file is going to end up very large.6.1.2 14 September 2007 change log28. To remove any advantage that spammers might get from the practice, no URL containing "http" or "www" will be logged by TNG.time to update?Scotty Quote Link to comment Share on other sites More sharing options...
Deni Posted February 4, 2008 Author Report Share Posted February 4, 2008 Probably. :-) Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.