I have been getting a lot of suspicious traffic lately to fightsplog.com. Today this spammy traffic ballooned to thousand of hits, so it is becoming a problem. Here is a chunk of my access log: 85.154.121.100 - - [30/Oct/2008:19:30:09 -0400] "GET /take-action.php HTTP/1.1" 200 290 "http://www.startimes2.com/f.aspx?mode=f&t=9958941&pg=3" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)" 70.132.23.7 - - [30/Oct/2008:19:30:17 -0400] "GET /take-action.php HTTP/1.1" 200 290 "http://forum.purseblog.com/balenciaga/celebrities-with-assorted-b-bags-pictures-only-12040-67.html" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.8.1.17) Gecko/20080829 Firefox/2.0.0.17" 24.23.136.56 - - [30/Oct/2008:19:30:18 -0400] "GET /take-action.php HTTP/1.1" 200 290 "http://www.pursedlips.net/category/shop/designer/gucci/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.17) Gecko/20080829 Firefox/2.0.0.17" 24.23.136.56 - - [30/Oct/2008:19:30:18 -0400] "GET /take-action.php HTTP/1.1" 200 290 "http://www.pursedlips.net/category/shop/designer/gucci/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.17) Gecko/20080829 Firefox/2.0.0.17" 24.23.136.56 - - [30/Oct/2008:19:30:18 -0400] "GET /take-action.php HTTP/1.1" 200 290 "http://www.pursedlips.net/category/shop/designer/gucci/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.17) Gecko/20080829 Firefox/2.0.0.17" 76.117.85.60 - - [30/Oct/2008:19:30:46 -0400] "GET /take-action.php HTTP/1.1" 200 3119 "http://victoria-beckham-clothes.blogspot.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7" 76.117.85.60 - - [30/Oct/2008:19:30:50 -0400] "GET /take-action.php HTTP/1.1" 200 3119 "http://victoria-beckham-clothes.blogspot.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7" Code (markup): I know its not real traffic because they only GET a single page and don't get the stylesheet or favicon, things a regular browser would get. There are also no links to my site from the referral pages. Anybody have any idea of why someone would be doing this? Are they just trying to waste my bandwidth because I have an anti-splog site? Anybody have any ideas about how I could stop this? Thanks
Thanks for the suggestion, gostats. I've never heard of those change detection plugins before, but I doubt that is the problem. The traffic from this "spammy" traffic is dwarfing my regular traffic (which is very low, like tens of visits a day), and my site hasn't changed in years, I doubt that suddenly there would be a bunch of people interested in up-to-the-minute changes in my site! I can't just ban the IP, because the traffic is from many different IPs.