Homepages for kids - not!

Topics

User Functions

Homepages for kids - not!
Tuesday, June 28 2005 @ 09:23 CEST Contributed by: Dirk
The notorious drugs spammer has found a new free hosting service to abuse: www.matmice.com, who provide "free homepages for kids". However, sites about Xanax, Valium, etc. are certainly not for kids ... Instead of blocking matmice.com, however, I'd suggest to block the IP the referrer spam is (still!) coming from: 69.50.180.186, if you haven't already done so.
Filed under: Referrer Spam ()

View Printable Version

Trackback

Trackback URL for this entry: http://spam.tinyweb.net/trackback.php/not-for-kids

No trackback comments for this entry.

Homepages for kids - not! | 10 comments | Create New Account

The following comments are owned by whomever posted them. This site is not responsible for what they say.

Already taken down

Kudos to matmice.com for quickly taking down those sites (while we were still getting referrer spam for them, in fact). Now if only other free services were at least half as speedy ...

Authored by: Dirk on Tuesday, June 28 2005 @ 03:36 CEST

[ Reply to This | # ]

Still spamming ...

The funny thing is that he's still spamming for those sites, although they have been taken down almost 24 hours ago now ...

Authored by: Dirk on Wednesday, June 29 2005 @ 10:17 CEST

[ Reply to This | # ]

Also doing porn spam now

It seems our friend here has created another site on matmice.com for which he's spamming now (someone hit him with a cluestick - and hit him hard, please).

In addition to that, he has now also started spamming for porn sites under what appears to be a free sudomain hoster in Kazakhstan (forever.kz). Those redirect to nastymary.com, which is hosted on that server in Estonia (217.159.201.132) mentioned in my earlier post.

Authored by: Dirk on Thursday, June 30 2005 @ 01:32 CEST

[ Reply to This | # ]

Also doing porn spam now

We've (matmice.com) blocked the spammer (settler.futures.ru / 217.15.18.194) with a firewall rule.

We'll keep deleting and blocking this guy until he stops using matmice. Hopefully, he gets the hint soon.

Authored by: Anonymous on Saturday, July 02 2005 @ 10:48 CEST

[ Reply to This | # ]

Also doing porn spam now

He's still doing it, I'm afraid to say. I had a link turn up in my referrer logs. I've forwaded that in an email to the webmaster address of Matmice.

Authored by: Anonymous on Sunday, July 10 2005 @ 01:08 CEST

[ Reply to This | # ]

Also doing porn spam now

Still doing what? Spamming for matmice addresses? I haven't seen any of those in days.

He's still spamming for those forever.kz addresses, though, but that has nothing to do with matmice, of course.

Authored by: Dirk on Sunday, July 10 2005 @ 01:18 CEST

[ Reply to This | # ]

Also doing porn spam now

The guy created one more matmice page, which we've now removed. Please let us know if you see any others, and we'll continue to shut them down.

Authored by: Anonymous on Sunday, July 10 2005 @ 04:37 CEST

[ Reply to This | # ]

Also doing porn spam now

He has switched subdomain services yet again. The porn spam is now referring to jamminweb.com, which belongs to the clueless group who also run 3d.net and dreamstation.com.

Authored by: Dirk on Tuesday, July 19 2005 @ 09:28 CEST

[ Reply to This | # ]

Now with faked Google referrers

A slight change in tactics of our "friend" here: He's now following most of his referrer spam with a fake Google referrer, like so:

69.50.180.186 - - [23/Jul/2005:06:31:55 -0400] "GET /index.php?page=17 HTTP/1.1" 403 26 "http://www.anzwers.org/trade/phentermines/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET"
69.50.180.186 - - [23/Jul/2005:06:31:55 -0400] "GET /index.php?page=17 HTTP/1.1" 403 26 "http://www.google.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET"
69.50.180.186 - - [23/Jul/2005:07:46:39 -0400] "GET /index.php?page=17 HTTP/1.1" 403 26 "http://phentermine-online.zenno.info" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET"
69.50.180.186 - - [23/Jul/2005:07:46:40 -0400] "GET /index.php?page=17 HTTP/1.1" 403 26 "http://www.google.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET"
69.50.180.186 - - [23/Jul/2005:08:34:56 -0400] "GET /index.php?page=17 HTTP/1.1" 403 26 "http://buy-phentermine.email.su" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET"
69.50.180.186 - - [23/Jul/2005:08:34:56 -0400] "GET /index.php?page=17 HTTP/1.1" 403 26 "http://www.google.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET"

Not sure what he hopes to accomplish with this - anyone should have blocked that IP address by now anyway.

Authored by: Dirk on Saturday, July 23 2005 @ 06:14 CEST

[ Reply to This | # ]

grrrrr.....wtf

is he still doing it ! is that why the site is getting blocked by websense?

Authored by: Anonymous on Thursday, January 11 2007 @ 02:21 CET

[ Reply to This | # ]

Damn Spam!
	Search