weird URL's

[dickbaker]

I got a phone call from an advertiser on my site. Their stats are showing visitors coming from unusual URL's on my site. I can't find anything in my stats on these, so I don't know how they're originating or from whom.

One form puts words before the "www", as in http://greenwww.mysite.com/brand/model.asp
Another just inserts a "a" before the www as in http://awww.mysite.com/brand/model.asp

Any idea what the perpetrator is trying to do, and how to stop it?

Thanks for any replies.

[edited by: phranque at 6:16 pm (utc) on Jul 17, 2013]
[edit reason] unlinked urls [/edit]

[dmorison]

It sounds like wildcard DNS [en.wikipedia.org] is configured against your domain name so anything.example.com is serving up your site - that would be the first thing to check / fix...

[dickbaker]

That's not it. I'm already set to not accept URL's with wildcards before the domain.

I've searched using every phrase I can think of to find something on putting letters or words before the "www", but can't find anything. I don't know what the person(s) using these URL's are trying to accomplish, but it's annoying my advertiser.

[lucy24]

I can't find anything in my stats on these, so I don't know how they're originating or from whom.

Never mind stats: look at raw logs.

Either the visitors are coming from your site or they're not. If they're not, it is not your problem and the advertiser can do whatever they normally do with a forged referer. If they ARE coming from your site, you can then research more deeply-- but don't bother about this part until you're sure they started out with you.

[phranque]

the only way i can see to verify anything is for your advertiser to provide the date/time and IP address of the referral and then for you to verify in your server access log that you had a preceding request for the referring page at that date and approximate time from that IP address.

otherwise, as lucy24 suggested, it's probably a faked request with a forged Referer: header.

[dickbaker]

Thank you so much. I'll ask my advertiser to provide the information. I hope it's something on his end, as my hosting company has said they don't deal with such issues.