Nasty trackbacks

I got three odd trackbacks on the site last night. They were all for the same article, came from all over the place (USA, Sweden) but all followed a pattern: The spamvertized URL was a subdomain that had something to do with music (beach-music, free-music-code-com, dr-dre-forgot-about-dre-music-lyrics). The main domains contained name of women and all ended in ...blog.info: anjaroxinblog.info, annamariablog.info, alianablog.info.

Don't visit those sites! There are all sorts of redirects and nasty JavaScripts involved here. It's been a while since I saw a popup open by itself in Firefox ... Some of the redirects aren't exactly safe for work either.

Back to the analysis: All three domains have only been registered on 2005-12-24, in all cases supposedly by the women who's names they carry, although those names and addresses are most likely fake. The sites themselves are hosted in Russia (on 212.158.165.152 and 217.23.143.17, belonging to Caravan Hosting in Moscow).

The most stupid thing about those trackbacks, though, was that the spamvertized URLs were missing the http:// part and were therefore useless ...

Digging through the logfiles, I also found a huge amount of other trackbacks, all targetting the same article as the three above, that had been blocked by Bad Behavior. That actually started two days ago. Both the successful and the blocked Trackbacks feature the same user agent string: "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"