Anyway

The aff people, that is. I am too, after some time spent in Aus­tralia with little access to the inter­net. Enough to notice my stats, but I had no inclin­a­tion to actu­ally do any­thing about them.

Look­ing at the logs, the aff people went away on Decem­ber 18 and star­ted send­ing refer­rers my way again on Decem­ber 23. Noth­ing seems to have changed about what they’re doing, and the explan­a­tion put forth by com­menters to the ori­gin­al post that it’s likely an attempt to scam the affil­i­ate pro­gram of an adult site seems the most likely explan­a­tion. I’m still not sure what (if any­thing) to do about this; if the band­width usage becomes excess­ive I’ll use one of the meth­ods sug­ges­ted by the com­menters to my ori­gin­al post. 

In the mean­time, I guess I’d bet­ter post some more inter­est­ing content…

The light shone on that dark corner of the inter­net (see my Framed! post, as well as Tim’s Fram­ing Lauren linked post) and it brought res­ults. If you haven’t read my post­ing, go ahead; there’s too much inform­a­tion to use­fully sum­mar­ize here and the com­ments are good too. 

After read­ing all the com­ments that came in (includ­ing some private email), Tim and I chat­ted a bit with Paul Hoff­man, noted IETF/IMC heavy. A likely explan­a­tion (as poin­ted out by many com­menters) is that the pur­vey­ors of the “aff” sites were prob­ably try­ing to run an affil­i­ate scam on the Adult Friend Find­er site. They prob­ably chose my site to frame because Tim has a high Page Rank and often links to my site, and thus my Page Rank is also reas­on­ably high. Paul checked and found that they were doing their own name serving, hid­ing them­selves quite effect­ively from us (well, giv­en more time and effort I’m sure Paul could have dug up more inform­a­tion, but it did­n’t seem worth it). 

I pos­ted my piece on Sat­urday and Tim poin­ted to it not long after­wards. By Sunday after­noon the “aff” sites were notice­ably slower and seemed to be going off the air. The last refer­rer I had to my site was from site 23 on Monday Decem­ber 18th at 10 am loc­al time; pinging the address shows it’s still there but there is no longer an http serv­er attached to it. The site is still in the Google index but I expect that to go away at some stage as well. So they reacted quickly; I expect we will nev­er know the entire story. I’ve learned two things though: keep a closer eye on my access logs, and post about things that look weird. 

This is a story of some of the dark corners of the inter­net, with a puzzle at the end and a request for advice…

Our story starts a few weeks ago. I had installed Stat­counter on the blog post­ings to keep an eye on who vis­its my blog and why, with more inform­a­tion than you get from per­us­ing access logs (I have those too). I also like fol­low­ing links back to refer­rers to see why they’re link­ing to my site, when I have time. A few weeks ago I noticed what looked like a spam site link­ing to my blog — you know the type of URL, it’s some non­sensic­al com­bin­a­tion of let­ters and digits. So I fol­lowed it back, only to find that it was a com­plete frame of my blog. View source showed only that my site was being framed. No oth­er con­tent was being added as ads, as meta con­tent, or any­thing else that I could see. Noth­ing that explained why they’re doing this.

So I looked up the whois for the site, dis­covered it’s hid­den by a com­pany called “Domains by Proxy”, which spe­cial­izes in hid­ing regis­tra­tion data for web sites. They have lots of inform­a­tion on their site about how they cooper­ate with law enforce­ment if people are doing some­thing illeg­al, which leads me to sus­pect that unless you can prove someone’s doing some­thing illeg­al they won’t do any­thing or even talk to you. Not that I tried talk­ing to them, since simply fram­ing my site isn’t illeg­al, or even con­tra­ven­ing my Cre­at­ive Com­mons license. It is, how­ever, highly suspicious.

A little more invest­ig­a­tion was in order; the num­ber of hits on my web­site from this site were increas­ing and oth­er ver­sions of the URL were show­ing up. The URL was of the form “aff” fol­lowed by “0000” fol­lowed by a num­ber, fol­lowed by .com (yes, it’s cir­cuit­ous, but I don’t want my site linked to theirs in search engines, for reas­ons that will become obvi­ous). I checked out and found that all num­bers from 1 to 28 poin­ted to my site. So someone paid to register 28 domains, host 28 domains, and put in HTML to point to my site? None of the URLs showed up in the com­mon search engines, but some­how they were being clicked on, seem­ingly by real people (spread of ISPs across the world, dif­fer­ent OSes, screen res­ol­u­tions, and browsers, all stay­ing for approx­im­ately zero seconds).

I con­tem­plated put­ting in some frame bust­ing code but decided to wait a little and see what happened, in case they were just get­ting ready to do some­thing. In the mean­time more of these sites start point­ing at mine. And finally one of them showed up in a search engine, and there it points to an adult site. One of those ones that may not be safe at work, at least judging by the front page. In which case the frame bust­ing isn’t the answer any­way, the people vis­it­ing this site don’t want to see my mus­ings on tech­no­logy, moth­er­hood, or knit­ting, they want the adult con­tent they expect.

Tim had the bright idea at this stage of using a com­mand-line fetch on the “aff” sites and found that the index page returns a list of poten­tial mis­spellings of the adult site’s name. About 10000 of them. The oth­er sites return sim­il­ar lists; num­ber 28 only returns about 7000 mis­spellings. If you search for one of these mis­spellings in a com­mon search engine, you land on an “aff” page, which then redir­ects you to the adult site. But only if you come from a search engine. If you type in that site name in the address bar, the redir­ect sends you to my blog.

So I have a couple of ques­tions, and would appre­ci­ate any thoughts or exper­i­ences you have.

1. Why are they not redir­ect­ing to the adult site, which is prob­ably what the people who are click­ing on an “aff” site prob­ably want? Why send them to anoth­er site? 
2. Related ques­tion: why me? Why someone who writes about tech­no­logy, and not someone on some free host­ing site who may not even notice the increase in traffic, let alone get sus­pi­cious about it?
3. What do I do about it? I could block people from “aff” site from link­ing to my site; receiv­ing a “You’re in timeout.” mes­sage (error 403 as seen by Mark Pil­grim) might have some effect. One related ques­tion to this is why people are going to an “aff” site any­way; since the “aff” sites redir­ect people com­ing from search engines to the actu­al adult site itself one could sup­pose nobody would ever click on it. Tim sug­ges­ted people might be curi­ous; they see the URL in the search engine list­ings and type it in the address bar to see what’s there.

The adult site itself does have a tech­nic­al con­tact in the whois registry but the pur­vey­ors of the “aff” sites might not be them. Sug­ges­tions wel­come… the hits I’m get­ting have grown from noth­ing a few weeks ago to now being a sub­stan­tial part of the dir­ect hits on my site so it’s a prob­lem I want to solve soon.