754 broken referrer spams

Topics

User Functions

754 broken referrer spams
Monday, June 06 2005 @ 20:18 CEST Contributed by: Dirk
Another episode from the "spammers are stupid" department: So we got another porn referrer spam - nothing new. But this one tried to spam an index.html page (which we don't have) with a referrer for a subdomain that has a space in it - an invalid URL. Other than that, it was a professional job: The referrer spams came from all over the world. The spamvertised domain is registered with Moniker, using their "Privacy Services" to hide the owner's identity. But they made another mistake: On the main site, sexchocolates.info, they had Google Ads - with their ID in it, of course (for the record: pub-1940530000905267). I'm sure Google's abuse departement will love this. Over the course of 7.5 hours, we received a total of 754 of these referrer spams - all the same, all broken. I'm not going to waste my time with Moniker, but The Planet (where the site is hosted) may be worth a try. Also at least one of the IPs where the referrer spams came from seems to be a virtual server in Germany - the owners might be interested in this. Other IPs looked more like hijacked PCs on DSL.
Filed under: Referrer Spam ()

View Printable Version

Trackback

Trackback URL for this entry: http://spam.tinyweb.net/trackback.php/broken-referrer-spam

No trackback comments for this entry.

754 broken referrer spams | 4 comments | Create New Account

The following comments are owned by whomever posted them. This site is not responsible for what they say.

754 broken referrer spams

As it turned out, the owner of the above-mentioned virtual server was running an anonyminizer proxy on it, but kindly forwarded me the parts of the logfiles that were targetting geeklog.net. So the spam apparently originated from 70.84.125.68, which is another server hosted at The Planet, very close to the one the spamvertized site is on (70.84.125.76).

This server hosts ecommerceseo.com (according to whois.webhosting.info, there's only one site on each of those two servers). I wonder if this (referrer spam) is the sort of "search engine optimisation" they are trying to sell through this site ...

That domain is also registered with Moniker, again using their Privacy Service. As Moniker is the preferred registrar of my special friends, The Bulgarians, I don't expect any help from them. Neither, it seems, can I expect anything from The Planet, as a quick search in Google Groups confirmed ([1], [2], etc.).

Authored by: Dirk on Wednesday, June 08 2005 @ 20:13 CEST

[ Reply to This | # ]

754 broken referrer spams

The site I admin is getting hit hard by these clowns. I am presently playing whack-a-mole with them, using a rather effective .htaccess script I found, although the thing is growing faster than the national deficit.

Interestingly, I have found from the logs that when they are hitting the site, they try twice, from an IP, get the 403's, then morph both IP and hostname.

I will be back here plenty often. You got good bogey dope here.

Authored by: Anonymous on Wednesday, April 19 2006 @ 14:39 CEST

[ Reply to This | # ]

Poker spam now

Seeing poker referrer spam made me immediately think of someone else, but it was only our "friend" here again, spamming for pokerbasicstrategy.com. That site has the same Google AdSense ID (pub-1940530000905267) on it. If you see this spam (or other spam pointing to sites with that same AdSense ID) make sure to let Google know. Hitting spammers where it hurts (the money they are making from all this) should be more effective than simply blocking them ...

The spamvertized site is on 70.84.125.77 (The Planet), which again is in the same IP range as in the above cases.

Authored by: Dirk on Wednesday, July 27 2005 @ 20:31 CEST

[ Reply to This | # ]

Poker spam now

I have traced a spammer back to Webair, one who is hitting us hard. Interestingly, the person I spoke to at webair(who couldn't get rid of me quick enough) had an Eastern European accent.

Interesting.

Authored by: Anonymous on Wednesday, May 10 2006 @ 21:09 CEST

[ Reply to This | # ]

Damn Spam!
	Search