Monitoring the Logs
Above you see a screenshot of a graph from my web site statistics. This graph shows the number of hits to my site on a daily basis over the last several months. As you can see, most of the time, the number of hits is pretty consistent. There have been two major incidents where things went way higher than normal.
The first one that you'll notice is the big spike in the center of the graph. That high point in the graph is the release date of the Spiderman 3 movie. A year before the movie, I wrote an article, containing lots of pictures describing my predictions for the movie. This article has been very popular, getting 16,000(!) views so far. This is much more, by far than any other article I've written. You'll notice a nice consistent increase in hits over time heading to the release date. Then, after the movie is released, the hits gradually decline. This is to be expected. As the movie release gets closer, people start to be more and more interested in it. Once people see the movie, interest drops off. This was a nice, natural spike in the logs. The other incident, however was not.
The second incident you see is over on the right side of the graph. Here you'll notice a nearly instant doubling of the number of hits going to my site. At first, I didn't think much about it. I just thought I was getting more visitors. It turns out this is not true. This sudden jump that you see is due to one web site - laguna2000.com. This website was singlehandedly doubling the traffic to my site and also sucking down tons of my bandwidth. After a couple weeks of this increased traffic, I found the problem. This is proof of the 'image blogging' problem I mentioned previously. One of the administrators of the discussion forum there decided to use one of my images from my blog about the Transformers movie as his 'avatar' image. In other words, every time he posted an article on the discussion forum or responded to an article, it would include his avatar image. This also mean that anytime someone read a message he posted, it would include his avatar image. The problem is that he chose to use my image as his avatar image. He was directly linking to the image on my web site as his avatar image. Everytime someone read one of his article on laguna2000.com, it was loading the image from my web site. There were a lot of people reading his posts on this site. I was seeing a good 3,000-4,000 hits per day coming from that site. That meant that I was literally giving them hundreds of megabytes of free bandwidth per day! In the several weeks that he was doing this, I likely provided several gigabytes of bandwidth to them for free. This had to change.
Saturday evening, I modified my site, to refuse to send any images to that web site, and only that web site. I'll write more about how I did that later. Ever since I blocked the images going to that site, I've seen laguna2000.com jump to the top of my failed referer list. In one day I got over 3,400 failed referers from this site - exactly what I intended. Looks like my hack to fix this little bit of theft works.
The moral of the story is to always watch your logs. When you see something weird, be sure to investigate. It might be something important.