1

The access log on my web server has a ton of HTTP HEAD requests coming from porn sites. What are HEAD requests and are they doing something bad with my site?

Here is an excerpt from my log:

(valid request)

xxx.xxx.xxx.xxx - - [02/Jan/2011:23:42:25 -0800] "POST /ajax HTTP/1.1" 200 0 "http://www.mywebsite.com/abc.html" "Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7"
(weird requests)
xxx.xxx.xxx.xxx - - [02/Jan/2011:23:43:11 -0800] "HEAD / HTTP/1.0" 302 185 "http://www.somepornsite.com" "Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.25 (jaunty) Firefox/3.8"
xxx.xxx.xxx.xxx - - [02/Jan/2011:23:43:11 -0800] "HEAD /valid.html HTTP/1.0" 200 16871 "http://www.somepornsite.com" "Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.25 (jaunty) Firefox/3.8"

(Web and IP addresses in this log have been munged.)

4
  • 3
    There's a dirty joke in this, somewhere. :-) Commented Jan 7, 2011 at 1:18
  • must randomize ip addresses in the question
    – abel
    Commented Jan 7, 2011 at 10:51
  • @Chris that was my first thought upon seeing the title, too :)
    – Pekka
    Commented Jan 7, 2011 at 15:55
  • Thanks for all the replies. Hopefully this is just referrer spam. I will log the actual requests and see exactly what they are posting.
    – Don Corley
    Commented Jan 8, 2011 at 0:01

2 Answers 2

5

Most likely attempts at referrer spam, but these could also be malicious (i.e. remote file inclusion attempts or contact form spam - particularly if you're running software which could be identified as vulnerable).

If possible, set up a script to log the post contents to see exactly what you're dealing with and get in touch with the ISP's hosting the domain(s) in question (particularly if this activity is adversely affecting your operation).

3
  • 1
    As soon as I saw the question I thought referrer spam
    – John Conde
    Commented Jan 7, 2011 at 3:55
  • 2
    Just for clarification, another idea behind referrer spam is exactly what you've just done. "Oohh, this is a new site linking to me! I wonder what it is... clickety click... virus " - since I found that out I've never clicked a referrer's URL. Commented Jan 7, 2011 at 4:11
  • @Farseeker - That's a great point - there are enough webmasters out there that I wouldn't be surprised if referrer spam pulled in as many hits as an e-mail spamming campaign.
    – danlefree
    Commented Jan 7, 2011 at 5:39
1

To answer your first question: with a normal page request (GET), the server returns some header information containing the page encoding, language and various other details. The page's content (<!DOCTYPE html....) then follows as normal.

HEAD requests are simply requests for a URL that only return the header information. I believe this is normally used to check the status of files, for example seeing if a cached image should be updated. It's also useful for validating that you implemented certain features correctly like gzip or caching.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.