User Agent ".WONKZ"

Wonky referers as Logspam?

[ExpLarry]

I've been seeing the odd log entry like this:

66.****.****.67 - - [14/Jun/2004:02:08:14 +0200] "GET / HTTP/1.1" 200 12647 "http://www.spammy-example-domain.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .WONKZ)"

where the "referrer" is a spammy domain a la "www.hotfarmyardwidgets.com" with no links to my site (at least I hope not!). The UA always ends in .WONKZ.

Anyone know what's behind this, and what's the point of it all? Do the perpetrators seriously believe web server log watchers are a big potential market?

Apologies if this is the wrong forum.

[jdMorgan]

The point is that lots of sites are misconfigured, and their "stats" are public -- try a search for any popular user-agent string, and you'll see tons of site log files filling the SERPs.

So, if these log spammers can hit just a few 'open stats' sites, presto -- lots of instant inbound links.

Stats files should be password-protected at the least. As long as stats files are left open, we're all subject to this waste of our resources.

Jim

[ExpLarry]

The point is that lots of sites are misconfigured, and their "stats" are public -- try a search for any popular user-agent string, and you'll see tons of site log files filling the SERPs.

copy... paste... google.

OMG. Other people's stats. In bucketfulls. This is fascinating stuff. There goes today ;-).

[ExpLarry]

got the little WONKZers ;-). Ran the grep-o-mat over the logs, it turns out the hits are coming from two adjacent IPs. It's only a few hits a day but over time I could end up paying bandwith for this son of a widget, so into the blacklist they go.