hide $_SERVER["HTTP_REFERER"] ?

[amazing_andr3]

I found a few strange visitors to my site. Using IE6, these visitors have hit a few pages of my site without specifying the referer on either of them ($_SERVER["HTTP_REFERER"] evaluated as false - i.e. "direct hit").

Now one of two things is possible. Either this is a bot pretending it's IE, or a legitimate visitor who's not sending the referrer information.

I don't know of any way to hide this information using IE, but I wonder, can some other software block it? Like an antivirus, firewall?

[PeOfEo]

why could they not just be going straight to that page? Are the pages something someone would bookmark?

[amazing_andr3]

yes, the first hit might be a direct hit, but the next ones should have as referrer my own site.

It's highly unlikely someone would visit 5 pages in a row by entering the address in the address bar, and not once use the links on the page.

[amazing_andr3]

the ip address resolves to your average personal website.

212.93.150.164

I don't know how to find its name.

Does this say anything?

[buntine]

Say hello to Cristina: http://212.93.150.164/

[Stephen Philbin]

Yes there is software to hide the referrer. Some people buy software that basically cripples their computers ability to communicate and operate in a normal way because they seem to believe the world will end if someone sees that they may have been to a porn site at some point in the computers life. The software developer laughs all the way to the bank and you are left with empty referers.

[amazing_andr3]

OK I've done a bit more research.

That page is cached by google as "cyclone.ro". However, cyclone.ro does not exist anymore. It doesn't figure on the .ro "WHOIS" service.

Which is strange since a .ro domain is registered "for life" and does not require a yearly fee. I say it's likely this domain had done something bad and that's why it's been removed.

However, I've decided to let the matter rest. It's probably not a robot but a strange user. It's visited my site on 5 different occasions in the last week and the way it's visited (missing the "printable view" link which is the first link on every page and others) really does suggest it's a legitimate user using the kind of software Mr Herer has suggested.

Or maybe he's dumb enough to cut and past the links into new windows (doesn't know there's a right mouse button).