Duplicate Log Entries Caused by the AddThis Widget

A search engine I develop was showing some odd behavior a few weeks ago. While making a few back-end enhancements, I noticed that many of the log entries were being duplicated. And they weren't the typical duplicates caused by a programming error. These entries were being entered after a 20 to 30 minute delay. Plus, the duplicates originated from a completely different IP address. Well, it turns out that the AddThis code I installed on the website was the culprit.

Background

A few years back, I wrote a post about incorporating the AddThis widget (Making it Easy for Visitors to Share Your Content with AddThis.com). Since then, I haven't made too many modifications except to update the code base as new versions of the AddThis widget were released. That and I also changed the method used to hide the HTML tags when JavaScript is disabled. Here is the most recent code:

<script type="text/javascript">
//<![CDATA[
document.writeln('<div class="addthis_toolbox addthis_default_style"><span class="addthis_separator">Share this page: </span>');
document.write('<a class="addthis_button_facebook"></a>');
document.write('<a class="addthis_button_linkedin"></a>');
document.write('<a class="addthis_button_twitter"></a>');
document.write('<a class="addthis_button_email"></a>');
document.write('<a class="addthis_button_compact"></a>');
document.write('</div>');
//]]>
</script>
<script type="text/javascript">var addthis_config = {"data_track_clickback":true};</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=XXXXXX"></script>

Odd Behavior

I guess the odd behavior has been going on for a while now. I've seen patterns in the past where different people appeared to be looking for the same thing. I didn't spend much time on the issue since I figured the visitors could have been directed on what to search. For example, maybe a newsletter went out that described how to pull up a set of resources based on some keywords and an author name.

Another clue was that some searches contained special characters like the ampersand. When the duplicates appeared, the ampersand was encoded. However, I thought that maybe someone was just more familiar with the Web and was experimenting for whatever reason.

Well, it wasn't until I was testing some new search engine features that I realized something was wrong. The stuff I typed while testing the script was being duplicated. What are the chances that someone's going to type something like "fhkdbjskjmj" on the same day as me…within a half hour? But just to make sure, I ran some test on a web development server and got the same results.

Investigation

After realizing the duplicate entries were being automated, I just needed to figure out where they come from. To do that, I decided to start with the IP address. When looking up 184.173.183.171 (one of the offending entries) at http://ip-lookup.net/, it said the address was hosted through clearspring.com.

Since that didn't ring a bell, I ran a Google search for clearspring. Luckily, the first result happened to be an article about the AddThis widget.

Conclusion

With a likely culprit, all that was left to do was temporarily remove the AddThis widget. Then try the search engine again and wait. After several tests and a few hours of waiting, the duplicates all disappeared.