website hotlinking/bandwidth theft

[Mïcrösöül°V³]

anyone know of a way to tell if/which files are being hotlinked on a website? My bandwidth consuption seems to be climbing like crazy, but the hit count doesnt add up. the only things that can be causing this is hotlinking. Ive moved all the files i share to another site, but it still continues. I have removed all the things i can think of that would cause an increase in bandwidth (including the paris hilton picture, which was getting slammed by google searches :P) is there anything i can do to find out which aspect of my site is the cause of the increase? (short of making an htaccess file, which works, but it messes up my frontpage extensions, and short of erasing the whole site) :( serious, do a google search under images for paris hilton. I am the 3rd row down

[Mr. Blunt]

You can't look in the stats in cPanel to see where the most bandwidth use is coming from?

[Mïcrösöül°V³]

1and1 doesnt seem to make it that easy
I have resorted to renaming all my html pages in hopes to cut off the hotlinks untill i come up with a better solution

[Vargas]

look at the referer

[sparsely]

if you have access to your server logs you can see exactly which files are being requested, and the url that is requesting them.

apache and other standard log files look like this:
1.1.1.1 - - [09/Feb/2005:18:09:27 -0800] "GET /nowplaying.php HTTP/1.1" 200 4110 "http://sparsely.deviantart.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0")

and it breaks down like this:
remote host (requesting IP address),
client username (a hyphen in the example)
authenticated username (also a hyphen here)
date (on the server),
the actual HTTP request line and method
the server response status code (list of status codes (http://www.w3.org/Protocols/HTTP/HTRESP.html))
the size of the file requested in bytes
the referring website (this is the part you're interested in)
the user agent and environment (browser) of the requester

depending on your hosts setup, you may see more or less info in your logs.
a hyphen represents information that wasn't gathered in the request, such as the username in the example above (wasn't applicable).

if you have cPanel, it's usually listen under 'Raw Access Logs'.

honestly though, I wouldn't worry too much about hotlinking.
not images anyway :|

edit 2 : if bots are really the problem, create a robots.txt file in your site's root.
or add meta tags to tell bots what to do.
you could prevent robots from indexing your image directories, and thier contents, but still index your site.

soemthing like
User-agent: *
Disallow: /images/
in a robots.txt file would work.

robots.txt syntax & tutorial (http://www.searchengineworld.com/robots/robots_tutorial.htm)

[Mïcrösöül°V³]

i found the control for my site, and it looks like i am averaging 5000+ hits a day for pictures of paris the slut. My website was only ever made to host a few files for kazaa people and just to have fun. It dont come with the bandwidth to support that kind of traffic, cuz then it costs me money....lots.
and it seems all my traffic (for the most part) is comming from google. If this continues I will have to upgrade my service and/or provider. :)

oh, thanks sparsley, i will try that :flowers: :)

[sparsely]

read the edited part about the robots.txt ;)

[Mïcrösöül°V³]

read the edited part about the robots.txt ;)
i read it, what do i use to make the file, notepad or sumpin? also, i dont see a cgi-bin folder on my server, i do have vti-bin and such....how confusing

[sparsely]

yeah, a standard text-edtior will work (notepad).
just put it in your site root.

like, where your main index.html is

[Mïcrösöül°V³]

cool. i guess a few days will tell then (the reports seem to be a day behind). thanks a bunch sparsely. If i have more questions about it, ill pM ya if thats ok :) or ill just post here some more :P

[tesco]

upload the paris picture to a different host...or on like sighost.org or imageshack or photobucket or something. :)