Odd question on DNS/domain name stuff...

[James Finstrom]

The referer is not official it is just an http header so most likely
someone spoofing the header

On 7/13/09, Jim March <1.jim.march at gmail.com> wrote:
> Folks,
>
> I have a friend who runs a website.  Every night he looks at the logs
> and checks to see where people are linking in from - usually
> discussion forums.
>
> He's got a regular trickle of incoming from a website that doesn't
> seem to exist:
>
> http://www.alchemistsrroom.us
>
> Drop one "r" from "rroom" and you do get a valid site, but it involves
> aromatherapy.  His site relates to a high-end handgun sight...that
> would be an odd linkage.
>
> Something else: I didn't know this, but people who mess around with
> homebrew explosives call themselves "alchemists", so there's obviously
> more of a cross-linked interest THERE than with aromatherapy.
>
> I've run "whois" searches on "alchemistsrroom.us" plus tried to go to
> the .com, .net, .org, .edu and even .gov versions of the same thing.
>
> So...first question is, why is this guy's server logs telling him
> links are coming in from a non-existent address?
>
> Possibly related question: is there a way to mask alchemistsrroom.us
> somehow, possibly by running a non-standard port
> (http://alchemistsrroom.us:8081 or something?)  If so, can we find it,
> and possibly locate an underground bomb-maker's forum or something?
>
> :)
>
> Jim
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>


-- 
James Finstrom
Rhino Equipment Corp.
http://rhinoequipment.com ~ http://postug.com
Phone: 1-877-RHINO-T1 ~ FAX: +1 (480) 961-1826
Twitter: http://twitter.com/rhinoequipment
IP: guest at asterisk.rhinoequipment.com