Accesses from China with fake referer

Has anybody seen this

[seindal]

I have gotten a lot of these in my log files recently.
The referer is completely fake (I changed the domain).

61.150.12.49 - - [12/Nov/2002:04:46:24 +0100]
"GET /photo/6183,s374.html HTTP/1.1" 200 4664
"http://www.fakereferer.dk/"
"Mozilla/4.0 (compatible; MSIE 5.01; Windows 98)"

The IP is from China:

inetnum: 61.150.0.0 - 61.150.31.255
netname: SNXIAN
descr: xi'an data branch,XIAN CITY SHAANXI PROVINCE
country: CN
admin-c: WWN1-AP
tech-c: WWN1-AP
mnt-by: MAINT-CHINANET-SHAANXI
mnt-lower: MAINT-CN-SNXIAN
changed: [e-mail] 20010309
status: ALLOCATED PORTABLE
source: APNIC

I see two explanations. Either somebody is copying parts of my site or they use some kind of anonymising proxy to hide their tracks on the net.

I don't want to block users that try to avoid a government like the chinese violating their privacy, but I don't like fake data in my logs either.

Has anybody else seen something like this? Does anybody know the explanation?

René

[BlobFisk]

Hi seindal,

I've never seen this myself - but there is a good chance that someone else here has and may have an answer to your question. It's been a bit quiet here yesterday and today... but that'll change!

*bump*

[davidf]

I can't give you a definite answer, but I'd guess it's a spammer looking for addresses. I've blocked a number of IPs from China and other Asian countries for similar abusive conduct.
I checked the IP 61.150.12.49 at openrbl.org and it has 6 out of 30 spam groups showing it positive for allowing spamming activity.

[seindal]

He was taking the images too. I had a close look at his session, and it looked fairly normal. He entered, fetched a few pages including all graphics and them left.

I regularly do a referrer scan of the logs to see how links to me and to see if I have too many links directly to the photographs. I have almost 6000 photos from Italy online, and sometimes people use them directly from my server, which I think is cheating. Normally the photos all have a referrer from my site, from the page they are shown on, by suddenly there was a lot of images referred directly from a site, that had no links to me and none of my photos.

I have recently seen a similar thing, but this time it was from Germany. Again something that seemed a completely legitimate visit.

Maybe it is just a browser bug?

René.

[bobriggs]

I'm not sure if you can get too excited about a fake referer.

There are third party proxy programs which you can set to any referer you want. And I can set my Mozilla to googlebot 2.1 or anything else I want to very easily.

I had a close look at his session, and it looked fairly normal

Probably was just that. Nothing but a fake referer string.
[big edit]
<brain f*rt>Sorry, thinking about UA strings</brain f*rt>

Sorry, could be a bot, but if it acted normally, I don't see why the same kind of third party proxy software couldn't set a referer to something static, most that I've seen just strip it out and it's not sent.