zombie pharma attack

Over the last few days my site has been under attack from zombies. Pharmaceutical zombies. Its yet another one of those incredibly irritating referrer attacks, except most of the time when I get one of those its only one or two referrers and they’re all coming from one IP. A couple hundred hits, I block them, they go away. This time: hundreds and hundreds of referrers, all for different drugs (viagra, vicodin, cialis, levitra, xanax). And all of them are coming from different IP addresses all over the world. Zombies. Its thousands and thousands of hits a day.

I’m dropping keywords into my block list all the time (fioricet. alprazolam. hydrocodone. phentermine. ambien.) but new ones are popping up every day. If you are a real human and you happen to be reading this from some legitimate pharmaceutical site, I’m sorry: you’re collateral damage.

This is really @*(#*@& annoying.

2 thoughts on “zombie pharma attack

  1. I have solved my referer spam problem in two different ways now.

    The first method involved a program to recognize referer spam based on a self-updating database, kind of like bogofilter. Another program would use that database to filter my web server logs before generating my daily report. This setup worked but was fairly heavyweight, and I was worried about false positives.

    The second method, which I’m using now, was to rewrite the referer section of my server log report so instead of showing the top N referers, it shows the top N referer->page pairs. The spammers like to hit a bunch of different pages instead of just one page, so all of the pairs they generate have low counts and they fall off the bottom of the list and don’t get shown. This has worked 100% so far, but I suppose some day a spammer might change tactics and hit one page a thousand times.

    In any case, it’s very fucking annoying.

Comments are closed.