Coresat.com

Over the last few days, this web site had been responsible for almost 30% of mt referrers. Yet I can't pin it down to an IP address in my logs, and doing a look up on the domain name gives an IP address that isn't IN my logs.

Go to the site, adn it it says "Website Suspended".

Anyone have any info on this?

 

I guess coresat is not only Your referrer spam. Search in google for "coresat.com" and You'll see.
Peace
Yoook

 

Yeah, I did a bunch of searches to get more info, and it shows up all over the place.

I just finished writing a script that grabs the referer right off the bat, and if it's coresat, I'm redirecting it back to coresat.com and then ending the session to keep it from taking up any more bandwidth.

 

What's the reasoning behind referer spoofing anyway?

 

If you publish your stats, they get links.

J.D.

 

Ah....

Well, I don't publush my stats and now any traffic with coresat as a referer is automatically redirected to coresat.com. On the up side, it forced me to tinker with my global.asa file, and now I have another weapon in my aresenal.

"You like apples?"

"How about them apples?"

 

For any ASP folks out there, here's the sub in my global.asa to redirect from foresta referers:


<script language="vbscript" runat="server">
sub Session_OnStart
If INSTR(LCASE(Request.ServerVariables("HTTP_REFERER")),"coresat.com") > 0 Then
response.redirect("http://www.corestat.com")
response.end
End If
end sub
</script>

It's easily adaptable to use against unwanted user agents as well. Instead of HTTP_REFERER, get HTTP_USER_AGENT. If you checking for more than a few, I'd recommend going with a Select Case statement as opposed to an If/Then.

 

any non jargon explanations available? Plz

i have about 80 hits from coresat in the past 3 days.(i barely noticed )
..i dont publish my stats..
so they get nothing?..am i understanding this right?
and my stats just go up by 80 hits?

or is there something more sinister at work here?

 

Not really. I have seen user-agent strings malformed on purpose so that confused log analyzers would drop these records and some hacking attempts would go somewhat unnoticed. Other than this it's just links.

J.D.