[analog-help] Strange referring site entries

[Aengus]

On Monday, September 11, 2006 11:57 AM [EDT],
Sarah Lander <slander at metsec.com> wrote:

> I have recently started to see a few strange entries in the referring
> site report. I get an entry for the site url like
>
> xxxx:+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
> ++++++++++/
>
> even though other sites in the list are shown OK.
>
> Am I correct in thinking this is some kind of default response from
> Analog,

I don't think this is an Analog default. It sounds more likely that it's a 
bogus referrer that's either being set by a worm/spider, or by someone who 
has installed a "privacy" option on their browser that blocks the referrer.

> and is it possible to overcome it? Basically I'm guessing the
> D column in the referring site report is going to be useful for
> tracking down the corresponding log entries, but what to do when I
> find them?

The simplest way to investigate this is to use REFINCLUDE which wwill 
restrict the report to only those entries that have that referrer, and run a 
report to see if the hits are only coming from a small range of IP 
addresses, and what browsers are involved.

http://analog.cx/docs/include.html

Aengus