1

The access log on my web server has a ton of HTTP HEAD requests coming from porn sites. What are HEAD requests and are they doing something bad with my site?

Here is an excerpt from my log:

(valid request)

xxx.xxx.xxx.xxx - - [02/Jan/2011:23:42:25 -0800] "POST /ajax HTTP/1.1" 200 0 "http://www.mywebsite.com/abc.html" "Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7"
(weird requests)
xxx.xxx.xxx.xxx - - [02/Jan/2011:23:43:11 -0800] "HEAD / HTTP/1.0" 302 185 "http://www.somepornsite.com" "Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.25 (jaunty) Firefox/3.8"
xxx.xxx.xxx.xxx - - [02/Jan/2011:23:43:11 -0800] "HEAD /valid.html HTTP/1.0" 200 16871 "http://www.somepornsite.com" "Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.25 (jaunty) Firefox/3.8"

(Web and IP addresses in this log have been munged.)

Improve this question
4
  • 3
    There's a dirty joke in this, somewhere. :-)
    – Chris W. Rea
    Jan 7, 2011 at 1:18
  • must randomize ip addresses in the question
    – abel
    Jan 7, 2011 at 10:51
  • @Chris that was my first thought upon seeing the title, too :)
    – Pekka
    Jan 7, 2011 at 15:55
  • Thanks for all the replies. Hopefully this is just referrer spam. I will log the actual requests and see exactly what they are posting.
    – Don Corley
    Jan 8, 2011 at 0:01

2 Answers 2

Reset to default
5

Most likely attempts at referrer spam, but these could also be malicious (i.e. remote file inclusion attempts or contact form spam - particularly if you're running software which could be identified as vulnerable).

If possible, set up a script to log the post contents to see exactly what you're dealing with and get in touch with the ISP's hosting the domain(s) in question (particularly if this activity is adversely affecting your operation).

Improve this answer
3
  • 1
    As soon as I saw the question I thought referrer spam
    – John Conde ♦
    Jan 7, 2011 at 3:55
  • 2
    Just for clarification, another idea behind referrer spam is exactly what you've just done. "Oohh, this is a new site linking to me! I wonder what it is... clickety click... virus " - since I found that out I've never clicked a referrer's URL.
    – Mark Henderson
    Jan 7, 2011 at 4:11
  • @Farseeker - That's a great point - there are enough webmasters out there that I wouldn't be surprised if referrer spam pulled in as many hits as an e-mail spamming campaign.
    – danlefree
    Jan 7, 2011 at 5:39
1

To answer your first question: with a normal page request (GET), the server returns some header information containing the page encoding, language and various other details. The page's content (<!DOCTYPE html....) then follows as normal.

HEAD requests are simply requests for a URL that only return the header information. I believe this is normally used to check the status of files, for example seeing if a cached image should be updated. It's also useful for validating that you implemented certain features correctly like gzip or caching.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy