Somebody Is “Hijacking” My URL

Question

I track traffic to the domains that I own through a "home brew" cookie system. One one site, I have noticed that I get a lot of HTTP referer traffic from one particular domain (http://www.getbig.com/). I did some sleuthing, and found out what this person has done. This person has attempted to use my sites logo as their avatar on a forum. However, instead of linking to the image in the "img" tag:

<img src="http://www.example.com/image.jpg" width="" height="" alt="" border ="" />

they have linked to my main domain name:

<img src="http://www.example.com/" width="" height="" alt="" border ="" />

Every single time a page is loaded where this person has posted in this forum, a new hit gets registered. This is artificially inflating my visitor statistics, and I would like to stop it. If they had simply linked to the image, I could just change the image name, but they have linked to the site itself and I am not sure what to do. Aside from sending them a "cease and desist", what technical options do I have?

Answer 1

The principle is called hotlinking – or at least it is when done correctly, as you pointed out. There are a few solutions to "stop" it from happening.

1. The most common one is to serve a different page or image instead of the expected one. Apache's mod_rewrite (or similar) allows you to rewrite URLs based on particular criteria, such as the referer header in this case. You will need to be at least allowed to create your own .htaccess file. There are tools to help generate the .htaccess content.

2. A less informative way to do this would be to deny access via environment variable. First check the referer header with SetEnvIf and deny access based on it. This would only return a HTTP#403 response code.

3. If you don't have this sort of access, you could read the referer header at the application level and make a decision there. This might only be a partial solution depending how the content is delivered (i.e. request handled by the webserver or an additional application layer such as PHP).

4. Contact the user in question. This is less scalable and doesn't stop them if they don't agree with your kind request.

The first three are solutions to stop hotlinking in general. They can be adjusted to match only a particular referer.

In this particular case, I doubt any of these will have a significant effect unless you provide a picture in response. If the URI doesn't contain the actual image name but only the protocol and domain name, the browsers opening the page are unlikely to show anything relevant for the img tag at the moment. Providing a different content won't change this situation, unless it's an image. Serving an image explaining why you don't allow hotlinking (even if they request the main page) would probably have a more important impact on the user.

It is difficult to assess how your statistics will be affected by these solutions. Assuming they are collected on the main page, they could bring the data back to normal as that page won't be served anymore. If they're based on the access logs, it might be a different story.

Answer 2

What I would recommend is check out the Referer, and if it is coming from http://www.getbig.com/, instead of your website you serve the absolute filthiest image you can find on the internet.

It's much, much easier to just send them an email though.. (this is my actual advice).