This article discusses how to create an link anonymiser service redirector to make use of the Analog CE 6.0.16+ ANONYMIZERURL setting.
Why use an anonymiser?
If a user clicks a link on an Analog CE “Requesting Site” or “Requesting URL” report. The users web browser will send a HTTP Referrer header with the request to download the web page; this request will include the full URL or your Analog CE report. The receiving server will likely log the request, allowing its owner to see where the request originated.
This may expose the Internet or Intranet URL or your stats page to the target website owner. They may in-turn inadvertantly publicise it via their own statistics page and/or link-back tracker service. This makes it possible for other agents, including competitors, search engines and malicious users to discover information about your website. Worse your web server may become the target of SEO spammers.
What is SEO spam?
SEO spam is the practice of attempting to improve a website/page position on a search engine by creating ‘false’ links into that website. If your referring site/URL report is public it is possible for a malicious actor to artificially position one or more URLs on the report. This is achieved through a manipulated HTTP GET request containing a HTTP Referrer header with the URL/site that they want to inject onto your report. After making several hundred requests in this fashion the spammer will wait for the report to be updated. After confirming that their site has appeared in the report, they submit your statistics page(s) to search engines.
Once compromised, it is likely that your exploitability will be recorded in one or more botnets and will see wider exploitation.
Why create your own anonymiser?
You can use public anonymiser services such as anonymizer.info or anon.to with Analog CE using one of the code samples below.
ANONYMIZERURL https://anon.to/?
ANONYMIZERURL https://anonymizer.info/?
This may not be acceptable to you, or your organisational security policy. Firstly because while the owner of the resultant web server will not discover the true origin of the request, the public anonymiser service will. Secondly, there is no contract assuring service availability or the privacy of its log files. Finally, it is inevitable that the service is going to profit from your transaction. Advertising placement is likely, creating a delay in the redirect.
Code your own Anonymous Link Redirector
The following code snippets can be used to program your own basic redirector using service side scripting technology.
ASP 3 / Classic ASP
<%@LANGUAGE="VBSCRIPT" CODEPAGE="65001" EnableSessionState="False"%>
<% Option Explicit %>
<%
Response.Status = "302 Found"
call Response.AddHeader("Location", Request.QueryString)
Response.End()
%>
Save the file as redirector.asp and add the following to your Analog CE global configuration file:
ANONYMIZERURL http://my-server.domain.com/redirector.asp?
ASP.net
<%@ Page Language="C#" %>
<script runat="server">
private void Page_Load(object sender, EventArgs e)
{
Response.Redirect(HttpContext.Current.Request.ServerVariables["QUERY_STRING"], true);
}
</script>
Save the file as redirector.aspx and add the following to your Analog CE global configuration file:
ANONYMIZERURL http://my-server.domain.com/redirector.aspx?
PHP
<?php
header('Location: ' . $_SERVER['QUERY_STRING'], true, 302);
exit;
?>
Save the file as redirector.php and add the following to your Analog CE global configuration file:
ANONYMIZERURL http://my-server.domain.com/redirector.php?
Conclusion
The above code samples illustrate how to create a redirector in several different languages. The redirector URL will be sent to the destination server however the originating statistics page will now be protected. This protects your Analog CE stats pages from prying eyes while reducing the risk of SEO spamming.