This has been going on for almost a week: Referrer spam from 217.107.222.75 for URLs on dating-s.net and two sites below bir.ru.
Not sure what's the point, though. Behind most of those URLs is the most horrid and broken HTML code that I've seen in a while and they're basically all linking to each other. The only giveaways are the /umax/sitemap/ URL and that the christa-worthington subdomain has a JavaScript redirect that does a "search" for Viagra (again, via a URL that contains "umax"). So I guess this is something out of the vicinity of the Umax spammer but probably not the same person.
dating-s.net is registered by a Dmitri K Lazarev from Tatarstan (is that a city?), Russia, with Direct Information Pvt. Ltd (directi.com) and hosted on 195.208.235.68 (Infobox / Alkor, St. Petersburg). 217.107.222.75 belongs to Arbatek Network in Moscow.
What's also interesting is that all the referrer spam was directed at the same URL on our site and that that URL isn't one you'd normally visit: It provides a "printer-friendly" view of forum posts, but it's only valid with an attached forum post id. Yet all the spam omitted that id. Checking the logfiles for that URL brought up a spamvertised subdomain of com.ru that also has a JavaScript redirect to a search for drugs on dating-s.net. That spam hit us on June 16th only (a week before the spam discussed above) and came from 195.208.235.68 directly.
Recommendation: Block both 217.107.222.75 and 195.208.235.68.
Comments (0)
Damn Spam!
http://spam.tinyweb.net/article.php/more-love-from-russia