suspicious link in my stats

[2tails]

Does anybody have a clue what this is? I've had is show up three times now. Obviously, the entry link and exit link have nothing to do with my site.

Here is the stat info

2
October 31st 2006 16:42:51
7 seconds
Konqueror 3.5
Linux
1600x1200 Returning Visits:



Referring URL: 0
Location: Florida, Miami, United States

host name:s7.buzzlogic.com (64.34.246.44)

entry page: /data/thumbnailer/work/home-2006-10-30-19:47:27.178/2006-10-31-15:57:51.626-in.html

exit page: /data/thumbnailer/work/home-2006-10-30-19:47:15.830/2006-10-31-15:57:57.638-in.html

No referring link

[rwil02]

Originally Posted by 2tails

Does anybody have a clue what this is? I've had is show up three times now. Obviously, the entry link and exit link have nothing to do with my site.

Here is the stat info

2
October 31st 2006 16:42:51
7 seconds
Konqueror 3.5
Linux
1600x1200 Returning Visits:



Referring URL: 0
Location: Florida, Miami, United States

host name:s7.buzzlogic.com (64.34.246.44)

entry page: /data/thumbnailer/work/home-2006-10-30-19:47:27.178/2006-10-31-15:57:51.626-in.html

exit page: /data/thumbnailer/work/home-2006-10-30-19:47:15.830/2006-10-31-15:57:57.638-in.html

No referring link

The requested URL would be:

http://s7.buzzlogic.com/data/thumbna...51.626-in.html

s7.buzzlogic.com is probably the webserver internal network designation.
So someone / something on the web hosts internal network is trying to locate files.

Given the path names, it could be an automatic process designed to generate thumbnails from images.
And it may be related to your site, or it may be that due to a configuration error, it is going to your site instead of the servers default website.

[deepsand]

Have you visited the Buzz Logic site?

Having done so, why would you find it strange to have been visited by someone there?

[rwil02]

Originally Posted by deepsand

Have you visited the Buzz Logic site?

Having done so, why would you find it strange to have been visited by someone there?

That's not what the data is saying though.
The data says that those are the pages that were the first and last pages visited ON HIS SITE.

The referring URL is '0'

s7.buzzlogic.com exists, but is refusing connections from the internet, so it almost has to have been from something on the webhosts intenral network.

[blitzen]

Odd, I looked up Buzzlogic.com from www.dnsstuff.com and this was the reply. What do you think?

WHOIS results for buzzlogic.com
Generated by www.DNSstuff.com

Unfortunately, this domain is registered through Network Solutions, who does not support
WHOIS lookups from DNSStuff.com because of the volume of hits from us.

If you don't like this policy, please send an E-mail to whoisquery@networksolutions.com
or call 1-888-642-9675 and let them know it you don't like it. Alternatively, you can
file a complaint with Internic.

If this is your domain, please consider using a registrar who values the services we provide.
If you have changed registrars, you can click here to update our cache...

[deepsand]

Originally Posted by rwil02

That's not what the data is saying though.
The data says that those are the pages that were the first and last pages visited ON HIS SITE.

The referring URL is '0'

s7.buzzlogic.com exists, but is refusing connections from the internet, so it almost has to have been from something on the webhosts intenral network.

1) The stats show the page being sought, regardless of whether or not such existed. In this case, the visitor was seeking a thumbnail. If, for example, you bookmark a site, and there is no favicon file present, that site's log will still show a request for such.

2) That there is no reported referring URL is not, in and of itself, suspicious.

[tmaster]

Originally Posted by 2tails

2
October 31st 2006 16:42:51
7 seconds
Konqueror 3.5
Linux
1600x1200 Returning Visits:

Looks like a robot scanning your site. I checked that site and its a snoop bot bor businesses so they can tell if you say anything about them. Ban the thing. They are stealing your bandwidth.

[deepsand]

Originally Posted by tmaster

Looks like a robot scanning your site. I checked that site and its a snoop bot bor businesses so they can tell if you say anything about them. Ban the thing. They are stealing your bandwidth.

And, the proof of your 2 allegations is what?

Do you know what a thumbnail is? How would a thumbnail provide the type of information that you claim is being sought?

[2tails]

Thank you for replying to this. I too, think it is a bot but would it be a consideration that it could be hits from a search engines cache of my site, somehow?

[deepsand]

Originally Posted by 2tails

Thank you for replying to this. I too, think it is a bot but would it be a consideration that it could be hits from a search engines cache of my site, somehow?

If you have ever had a thumbnail for your site, then it is possible that it could be a visit originating from a cache.

As for being a bot, without viewing the raw server log in its entirety, one can only speculate.

[pdrew]

Direct from Buzz Logic's FAQs:

Q. Who is BuzzLogic’s customer? How will they use it?
A. BuzzLogic’s first application is intended for marketers managing brands, reputations, products and customer relationships. One pressing need is among public relations practitioners, who will use BuzzLogic to monitor conversations that are taking place around a company, brand, products or competitors. With BuzzLogic, a pr practitioner will quickly identify the most influential participants of a conversation. She will have the ability to engage in order to set the record straight or perhaps amplify key points, and then follow, track and understand the impact of her action. Other marketing and research managers will use BuzzLogic to keep a finger on the pulse of markets, and to gain insight into the conversations that are forming around customer needs and wants. Customer service managers will use BuzzLogic to keep tabs on customer concerns, and nip potential problems in the bud. Public relations and marketing agencies will rely on BuzzLogic to help them develop and execute programs on behalf of their customers.

I did a search for Thumbnailer. This is what it does:

* Wizards to help you get up and running quickly
* JPG, GIF, MPEG, JPEG-2000, PNG, TIFF, PCX, BMP, WBMP, PhotoCD, Photoshop, TGA, ASCII, WMF and EMF
* AVI, TTF (TrueType Fonts), animated GIF and multi-page TIFF frame extraction
* Support for reading RAW, NEF, FlashPix, video files and more via plug-ins.
* Batch or single file operation
* HTML page generator, with links, tables, HTML templates, and more.
* Output images in a wide choice of formats and color depths
* Apply contrast, sharpening, brightness corrections
* Copy EXIF and IPTC data from JPG files



* Overlay text and images (great for logos, watermarks, copyrights)
* Automatic background matte
* Multiple resizing methods (including DPI change, percent resize and more)
* Image edge fades
* Composite (contact sheet) creation
* Customizable input and output file name filters
* DOS command line operation. If you need quick and simple image processing in a DOS-only environment, check out SASuite.
* Image import and image processing plug-ins
* On-line help
* much much more.

Buzz Logic is snooping for any number of reasons one could imagine. Say, checking images for copyright infringement, locating images of a client's product or service to see how much play it's getting on the Web, or trying to determine the context in which a client's image is being used, etc.

It's an uninvited bot that collects info for public relations and marketing reasons. It's a personal decision whether to ban it or not. It is taking up bandwidth on a site you're paying for and you're getting nothing in return, which might be the most relevant factor here. I'm sure this type of snooping and info gathering will only increase as the Web matures. Just as we have "do not call" lists for tele-marketers, maybe someday we'll have "do not snoop" lists for bots.

[deepsand]

Originally Posted by pdrew

Direct from Buzz Logic's FAQs:

Q. Who is BuzzLogic’s customer? How will they use it?
A. BuzzLogic’s first application is intended for marketers managing brands, reputations, products and customer relationships. One pressing need is among public relations practitioners, who will use BuzzLogic to monitor conversations that are taking place around a company, brand, products or competitors. With BuzzLogic, a pr practitioner will quickly identify the most influential participants of a conversation. She will have the ability to engage in order to set the record straight or perhaps amplify key points, and then follow, track and understand the impact of her action. Other marketing and research managers will use BuzzLogic to keep a finger on the pulse of markets, and to gain insight into the conversations that are forming around customer needs and wants. Customer service managers will use BuzzLogic to keep tabs on customer concerns, and nip potential problems in the bud. Public relations and marketing agencies will rely on BuzzLogic to help them develop and execute programs on behalf of their customers.

I did a search for Thumbnailer. This is what it does:

* Wizards to help you get up and running quickly
* JPG, GIF, MPEG, JPEG-2000, PNG, TIFF, PCX, BMP, WBMP, PhotoCD, Photoshop, TGA, ASCII, WMF and EMF
* AVI, TTF (TrueType Fonts), animated GIF and multi-page TIFF frame extraction
* Support for reading RAW, NEF, FlashPix, video files and more via plug-ins.
* Batch or single file operation
* HTML page generator, with links, tables, HTML templates, and more.
* Output images in a wide choice of formats and color depths
* Apply contrast, sharpening, brightness corrections
* Copy EXIF and IPTC data from JPG files



* Overlay text and images (great for logos, watermarks, copyrights)
* Automatic background matte
* Multiple resizing methods (including DPI change, percent resize and more)
* Image edge fades
* Composite (contact sheet) creation
* Customizable input and output file name filters
* DOS command line operation. If you need quick and simple image processing in a DOS-only environment, check out SASuite.
* Image import and image processing plug-ins
* On-line help
* much much more.

Buzz Logic is snooping for any number of reasons one could imagine. Say, checking images for copyright infringement, locating images of a client's product or service to see how much play it's getting on the Web, or trying to determine the context in which a client's image is being used, etc.

It's an uninvited bot that collects info for public relations and marketing reasons. It's a personal decision whether to ban it or not. It is taking up bandwidth on a site you're paying for and you're getting nothing in return, which might be the most relevant factor here. I'm sure this type of snooping and info gathering will only increase as the Web matures. Just as we have "do not call" lists for tele-marketers, maybe someday we'll have "do not snoop" lists for bots.

Nope. A thumbnail will not provide the kind of information alluded to.

And, since when is it "snooping" to gather information about you that others are saying in public?

In this particular instance, it may be that they are seeking instances of unauthorized use of copyrighted material, as evidenced by the use of someone else's thumbnail.

As for the bandwidth use, it's negligible to the point of being vanishing small; it's a non-issue.

It is worth noting that the I-net is public communications, not private. If you don't want it to be accessible to others, don't place it on the net!

[2tails]

It is worth noting that the I-net is public communications, not private. If you don't want it to be accessible to others, don't place it on the net!

duh... I am well aware of that. And since companies do send products for me to test and review, I suspect that it is one of them trying to see how much traffic is being generated from an image or review in particular.

I do not have anything on the site that I would be concerned about being copyright infringement or whatever so the marketing aspect sounds more inline with what I am thinking. Thanks!

[deepsand]

Originally Posted by 2tails

duh... I am well aware of that. And since companies do send products for me to test and review, I suspect that it is one of them trying to see how much traffic is being generated from an image or review in particular.

I do not have anything on the site that I would be concerned about being copyright infringement or whatever so the marketing aspect sounds more inline with what I am thinking. Thanks!

Note: My post was not directed to you, but was in response to pdrew. There was, therefore, no implication re. the content of your site, your awareness of the public nature of the 'net, etc..

As for traffic coming from your site, such would require 1) that your site have an out-bound link to a site managed by them, and 2) that they view traffic stats for the target site.

The visitor here in question was looking for the presence of a specific image, i.e. the name thumbnail.

[greeneagle]

Referrer Spam is common and definitely nothing to worry about.

Ken

[2tails]

ahh.. I apologize. Well, I do link images that I create or that is provided to me from companies and that may very well be the reason. But I usually, if not always link images from my own server. hmmm...

[greeneagle]

2tails,

Referrer Spam has nothing to do with anything on your site or practice that you may use. It's a more sophisticated spamming technique whereby shady characters spam your "referrer" stats more directly hoping you will visit their site and engage their services.

I get many per month.

Just disregard their garbage like you do with e-mail spam.

By the way, Welcome to WPW.

Ken

[2tails]

Thank you for the welcome aboard offering GreenEagle. I appreciate that.

The only thing that bothers me and allows me to hesitate in my decision on what to do with this is the / beginning. For me, it stinks of someone copying files or content/images. Oh well, no matter really. I blocked the s7.buzz'whatever' is was.com and the ip associated and I haven't had another visit. I just hope that I haven't banned something I may later regret.

[deepsand]

Originally Posted by 2tails

Thank you for the welcome aboard offering GreenEagle. I appreciate that.

The only thing that bothers me and allows me to hesitate in my decision on what to do with this is the / beginning. For me, it stinks of someone copying files or content/images. Oh well, no matter really. I blocked the s7.buzz'whatever' is was.com and the ip associated and I haven't had another visit. I just hope that I haven't banned something I may later regret.

The "/" to which you refer in nothing more than an addressing convention; in this case, it means that this is a relative identifier, i.e. that the path to following to the desired destination begins within the (sub)directory currently being accessed, just as it would if you were navigating the directory tree on your local hard drive.

E.g., if one is at the "index" page of www.xyz.com, i.e. at "www.xyz.com/index," and seeks "/data/work/abc.ext," this means "www.xyz.com/index/data/work/abc.ext" .

The use of relative addressing dates back to the earliest computers, and is not a telltale sign of mischief.

As for "copying," there is no evidence here of any attempt at such; any file which is, for example, to be rendered for display on a visitor's browser must be requested from your server. What happens at the requester's end is unknown to you.

As for having blocked this particular visitor, in the absence of any evidence to suggest that such would be beneficial to you, you may have unwittingly acted so as to no longer gain some as yet unknown benefit from such visits. Sometimes, doing nothing is the better course of action, particularly when all the material facts are not known.

[2tails]

As for having blocked this particular visitor, in the absence of any evidence to suggest that such would be beneficial to you, you may have unwittingly acted so as to no longer gain some as yet unknown benefit from such visits. Sometimes, doing nothing is the better course of action, particularly when all the material facts are not known.

Deepsand, that is exactly what I am concerned about by blocking it. I can not believe I've let something so simple torture me so much. I feel like an idiot.

I usually don't let these things bother me but it wasn't more than a month ago that I clicked on a bookmark of a forum I had (and had had for 4 years) only to find there was nothing but a hacked message there. Okay... so it had only been a year since I backed up the database. (spank me)... I just started over. So naturally, I am getting a bit paranoid these days.

I suppose I could unblock it and just make sure all my data is regularly backed up.

[deepsand]

Originally Posted by 2tails

Deepsand, that is exactly what I am concerned about by blocking it. I can not believe I've let something so simple torture me so much. I feel like an idiot.

I usually don't let these things bother me but it wasn't more than a month ago that I clicked on a bookmark of a forum I had (and had had for 4 years) only to find there was nothing but a hacked message there. Okay... so it had only been a year since I backed up the database. (spank me)... I just started over. So naturally, I am getting a bit paranoid these days.

I suppose I could unblock it and just make sure all my data is regularly backed up.

1) Bear in mind that only well behaved bots pay any mind to your robots.txt, etc.; and, that such bots are not the threats to guard against.

2) Your site's security is only as good as that of the host server; unless you've direct control of the server, your site's fate is in the hands of another.