404 errors on /images/blank.gif

Hi.

I have a rather complicated domain set-up- we have around 300 domains registered ( mostly misspelt versions of our main domain brand ) and all use a 301 redirect to our main domain.

Recently the I started getting lots of single requests for "/images/blank.gif" on all my domains.

Of course, each caused a 404 as that image is not in my site.

All requests referred by domains that are registered or held by enom.com, and all resolve to a holding page with a "buy this domain" text ( eg www.keukenwebsite.com/zedelgem1.htm ) but many are very unlikely to be real URLs, eg http://ba8wer25vyn248vm98azrv9nc9wer9o2qrncalwrvnlwaoruevno.com/?_index_key=71021&_struct_key=stu701

As a stop gap measure, I put up a largish blank.gif in the folder, to waste its time and bandwidth ( and keep my logs clean! ), but what is this?

A bot probing for active/inactive domains would not look for a possible image in a possible folder ( I already have a few of those bots visiting! ) and requesting a non-existent page will only get a 404 sent- with a few headers identifying the server as a Windows server. Why does it not then request the default page, to get the same info?

Is it malicious? Looking for weaknesses? Or what?

And, as it is irritating me now, having been sent an email reporting its visits- it is visiting each of my domains once a day- what can I do to stop it/irritate its owner?

My initial though would be to 301 redirect to some other random website or straight back to the referer. But I cant be sure that the ""referrer" is really correct.

Edit - Windows Server 2003, IIS6, and I dont have logfiles for the above as the final domain is on 2 load-balanced servers. I am emailed with 400, 404 and 500 errors though, and various data regarding requested pages.

Well, no-one seems to know, googling "images/blank.gif" is beyond pointless; so I am directing all such requests to a "400 Bad Request" error page.

Thanks to those of you who read my question

I've been experiencing this same problem. In fact that's how I found this thread through Google. I'm sure this must be a widespread phenomenon because I get these requests on every domain I own.

Just like you I'd thought of uploading a large gif or redirecting back to the refering site in order to deter these sorts of requests.

I've deduced that these hits are the result of a domain owner who is advertising through referer logs (in other words he hits random servers these fake requests for blank.gif hoping admins will be curious enough to click through to the affiliate site to increase impressions and hopefully click-throughs). I know, it's kind of a lame way of driving traffic, but I think we've seen all kinds by now when it comes to online marketing schemes

HTH,

Randall