(A note to companies thinking of resorting to referrer log marketing: don’t. It’s annoying and unethical, it has little effect on your search engine rankings since most referrer logs are private, and your money is wasted on a few lines of code that any script kiddie could throw together in a few minutes. People — especially webmasters — will hate you, search engines will blacklist you, and the overall exposure to your business will be resoundingly negative. Case in point: why is this entry near the top of search listings without any help from referrer spam, and why are Reffy and “PRStorm” nowhere on the first page of results?)

The clear villain in the world of Referrer Spam is Adminshop.com, makers of Reffy, software devoted to server-intensive referral log spamming. As near as I can gather, the owner of Adminshop is an Australian white supremacist who goes by the online handle of Odin. J-Walk, Richard@Home, and Tuxedo Jack have had runs-in with him and his poor ethical outlook, and Rui at TaoOfMac has actually given Reffy a try. Not only does it clutter up referrer logs, it also consumes site bandwidth, uses GET and closes sockets to consume CPU cycles, and relies on a zombie network of trojan-infected Windows PCs to work its evil. It’s more than an annoyance; it can work like a DDOS attack, slowing or even bringing down your website or server.

This is one of the “tools” on the web which, when rel="nofollow" gets widely implemented, will become ineffectual as a marketing strategy.

On a related note, Kalsey talks about taking down the automated form spammers, in an entry which, amusingly enough, is at the top of a Google search for such scripts, thus belying the effectiveness of such unethical marketing programs.

Update: On top of things as always, Ann Elisabeth has tons more info on the Reffy spammers.

Update: Reffy has renamed itself “PRStorm,” and got sold to some sucker who thinks it’ll help his business. One may as well have thrown the money spent on PRStorm in a trash can.

Another take on rel="nofollow." It’s not so much a way to stop spammers from spamming your weblog as it is a way for the search engines to keep from stepping in the overflowing fecal waste. Nonetheless, it makes me feel good that from now onwards, spammers’ efforts to use our sites for their pagerank will be in vain.

Also see “Let No Fellow Nofollow Lest We All Lie Fallow.”

No sooner has weblog spam become a significant issue to me than Google steps in with rel="nofollow", a proposal to keep links from being abused by spammers. (Also see the news from Six Apart.) This has applications towards referrer spam as well; all it takes is a line or two of code in our referrer log scripts to render all outbound links worthless to the search engine “optimizers.” Wikis, likewise, and any other system where user-generated links and content are at risk for abuse.

There’s only one major problem: cobweblogs, those outdated sites by noncommittal webloggers who post a few entries, then forget about their Movabletype or WordPress installations, leaving them to gather dust, and spam. Look at these search results, for example. Spammers can still target those people.

If you have a friend who still keeps a cobweblog, do him — and the rest of the internet — a favor, and ask that friend to either upgrade it, or delete it. Every little bit helps. And if you produce or use a referrer log script like Shortstat or Refer, it’s time for an upgrade.

Dear Blog Spammers: Congratulations. Let it sink in: you’ve made an enemy out of Google.

Referrer Spam. For myself and for anyone curious about my inbound traffic, my installation of Refer is public, but hidden from search engines by a robots exclusion <meta>. That, as many of you webmasters may have found by now, does nothing to deter referrer spam.

As of late, this site and many others have been under attack by a persistent referrer and blog comment spammer, with visits from just about every open proxy on the web, plus more than a few zombie machines, linking back to dozens, perhaps hundreds, of domains. Each of the domains uses fake whois info, and showed, until recently, a fake “suspension” notice to throw off any webmasters who followed the link, fooling them into thinking that the spammer had already been taken out. The jubilation was premature, of course: the sites are now flooded with links to all sorts of sleazy online scams, their pagerank artificially boosted by spam posted to unmaintained weblog comment threads and referrer logs. The flood of inbound traffic from this spammer’s zombie network is so heavy that it operates like a DOS attack: consuming bandwidth, sucking up server resources, and slowing — or even bringing down — the victim site. Witness the growing tide of spammed referrers, or see an untended referrer log taken over by pornographic links.

Myself, I’m keeping most of the flood at bay with an .htaccess blacklist. Amusingly, the spammer’s own comment spams, huge strings of domains inside <h1> tags, are an excellent way to generate a domain-based blacklist, since he seems quite intent on flooding comment threads with almost every domain he’s registered. Denying by IP is an exercise in futility, since the zombie network just keeps growing, most likely fed by trojans installed by the unsuspecting clicks of indiscriminate file sharers.

More info on this attack elsewhere:

• Norweigan blogger Ann Elisabeth has been very much on top of the problem, getting info from open proxies, complaining to the FTC, emailing and calling the colo/hosting services used by the spammer.
• Caveat Lector has .htaccess tips for domain-based blocking. Also watch his her Spam category.
• JLuster wonders about “Thomas Reece,” one of the [most likely] fake identities used in the spammer’s whois info. A very annoyed Tim Bray tried calling, but didn’t get too far. I might try calling too, if no one else has tried? Anyone?
• Arve Bersvendsen and ThePete comment on the fake “suspended” pages and the spammer’s webhost.
• John Sinteur has a quick PHP code block which redirects the referrer spam right back to the spammer.
• Track this story on Technorati through the spam tag and links to Ann Elisabeth’s efforts.
• And remember this from the not-too-distant past: Mark Pilgrim on weblog spam. War is hell.

Update, 25 Jan 2005: Ann Elisabeth seems to have discovered the culprits, and Photodude laments Verio’s poor response to the crisis.