Block 81.95.144.66 - Damn Spam!

Topics

User Functions

Block 81.95.144.66
Saturday, February 03 2007 @ 19:34 CET Contributed by: Dirk
Dear stupid trackback spammer at 81.95.144.66, in case you haven't noticed yet: None of the trackback spams you have attempted to send to this and a couple of other sites over the last 24 hours has made it through. They are deleted automatically, and I didn't even have to block your IP address ... Sincerely, The Management There's a reason why we haven't seen a lot of trackback spam recently, but it seems someone in Russia (81.95.144.66 belongs to Russian Business Network in St. Petersburg) hasn't gotten the memo yet. Oh, and while you're at it, block 81.95.144.67 through to .70, too. I see Bad Behavior takes care of those already (claiming to be GoogleBot isn't really helping in getting trackback spam through), but just in case.
Filed under: Comment Spam ()

View Printable Version

Trackback

Trackback URL for this entry: http://spam.tinyweb.net/trackback.php/block-81.95.144.66

Here's what others have to say about 'Block 81.95.144.66':

Spacequad Anti-Spam from Spacequad AntiSpam Services
We've had our fair share of trackbacks but have decided to block them mostly at the router now and for more than a few months now, we have not received any valid trackbacks. How does that happen...hmmm, I wonder. Sounds like most of them are coming f... [read more]
Tracked on Tuesday, March 20 2007 @ 04:00 CET

Block 81.95.144.66 | 7 comments | Create New Account

The following comments are owned by whomever posted them. This site is not responsible for what they say.

Block 81.95.144.66-70

A month later and he's still spamming this site. Sheesh ...

Authored by: Dirk on Tuesday, March 06 2007 @ 19:49 CET

[ Reply to This | # ]

Moved to Panama?

Hmm, interesting. The trackback spam is now coming exclusively from 81.95.144.102, which is in the same IP address block, but the address of the owner of the entire block has changed. It is now listed as RBusiness Network (hiding the "Russian") and is now located in Panama.

Authored by: Dirk on Sunday, March 11 2007 @ 14:09 CET

[ Reply to This | # ]

Moved to Panama?

Yep, I'm getting probably hundreds of hits from 81.95.144.102 daily, over the last couple of weeks. I have the range blocked, but it keeps trying and trying. Idiots.

Authored by: Anonymous on Monday, March 19 2007 @ 11:54 CET

[ Reply to This | # ]

Block 'em all

Haven't seen this spammer in a while, but it seems he's back now, spamming from 81.95.146.227, which is still in the same IP address range (81.95.144.0 - 81.95.147.255) belonging to RBusiness Network. So I guess it's safe to recommend to block the entire address range.

Authored by: Dirk on Thursday, June 14 2007 @ 11:33 CEST

[ Reply to This | # ]

Block 'em all

Oh, and I just noticed that I had already blocked the neighboring address block, 81.95.148.0-81.95.151.255, which also belongs to those guys.

Authored by: Dirk on Thursday, June 14 2007 @ 11:37 CEST

[ Reply to This | # ]

Connection to MPack / IFrame exploits?

Heise has an article (in German) about a web attack toolkit called MPack. The article goes on to mention that one of the trojans installed via MPack and the IFrame exploits is called Torpig, which originates from Russian Business Network (RBN) (that same information can also be found in the SANS article linked above).

One more reason to block these guys ...

Authored by: Dirk on Thursday, June 21 2007 @ 16:06 CEST

[ Reply to This | # ]

Slashdot article

Slashdot has an article on the Russian Business Network.

Authored by: Dirk on Sunday, October 14 2007 @ 10:09 CEST

[ Reply to This | # ]